A couple of PDF exploits from iMessage and Signal leading to code execution, and an app that roots the phone. Also, they seem to have managed to make their malware survive a reboot, which is difficult. That's another reason why automatic reboots are considered a security feature: exploits leaving malware in-memory are a lot easier to build than malware that survives a full reboot, passing all stages of signature checks and validation.

Yes, why don't they just say it instead of posting videos. Opening a sinister PDF in iOS can give them access to what exactly? anything/everything? What iOS versions or devices, etc?

Rooting, pretty much. Aka, executing code which shows their flying logo, but could also be exfiltrating data without displaying anything.