Unless you are of interest to an exceedingly well-funded adversary, what you might imagine is exceedingly unlikely.
Yes, malware exists for iPhone and iPad, it’s just really expensive and its use targeted, based on what information is available. Full-remote exploits are worth roughly one to two million dollars, each.
What might have happened is a compromise to your Apple Account and/or to your device passcode.
Start here: Use Safety Check on iPhone to stop sharing and secure your account - Apple Support
The rest of that document might interest you here, as well.
And then here: If you think your Apple Account has been compromised - Apple Support
If your devices have been unsecured and out of your control, perform a factory reset and restore just the data and accounts and apps you want.
How to factory reset your iPhone, iPad, or iPod touch - Apple Support
If you suspect a breach, change all of your passwords, and passcodes, including those passwords for your email accounts and for other password-reset paths, social media, and otherwise. Enable two-factor authentication, as well.
There are other means to track people entirely unrelated to Apple gear, of course.