Legally? No, they can’t, not without your permission (unless required by a court or any agency allowed to do so by law).

In practice? If they can remotely change your whole OS, then they can do whatever they want to any data that’s on, or can be gathered by, the phone.