It is technically possible to set up this type of surveillance without raising alarms, and it has been reported by credible sources to have been used by both the FBI and foreign governments to surveil cell phones, as is discussed in this related question.
There are well known techniques for surreptitiously "rooting" or "jailbreaking" a phone, which is typically a prerequisite to configuring the phone for this type of surveillance. For example, a few years ago it was demonstrated at the prestigious Black Hat conference that plugging a phone into a malicious USB charger can automatically install malicious code onto the phone. (Black Hat is the same venue in which Femtocell hacking, referred to above as the "fake base station attack", was publicized.) Therefore, all the attacker would need to do is get the target to plug in his or her phone into a malicious charger once. There have also been many so-called "untethered" jailbreaks to iOS, in which the phone can be infected with malicious software without the need of an external device or computer, typically by accessing a specially crafted webpage. There have also been a number of exploits in which a text message can install malicious software onto a phone.
Once the attacker has rooted/jailbroken the target phone, he or she has ultimate control over the device. There is well known software such as "PowerDown Enhancer" that proves it is possible to reconfigure the power button to, for example, run an app rather than shut down the device. That app could display a screen that looks identical to the phone's normal shutdown screen, and then turn off the display, but remain running. During this time it could do whatever it likes: record audio, report GPS location, accept remote commands, et cetera. When the power button is pressed again, the app simply displays a fake boot screen and then hides itself. The only indication to the target that something is awry might be reduced battery life and/or increased data usage.
Finally, it is important to remember that governments have many other resources at their disposal for espionage. Here is an excerpt from my favorite computer security paper, This World of Ours, by James Mickens and published by Usenix:
either dealing with Mossad or not-Mossad. If your adversary is
not-Mossad, then you’ll probably be fine if you pick a good password
and don’t respond to emails from ChEaPestPAiNPi11s@
virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE
GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO
ABOUT IT. The Mossad is not intimidated by the fact that you
employ https://. If the Mossad wants your data, they’re going to
use a drone to replace your cellphone with a piece of uranium
that’s shaped like a cellphone, and when you die of tumors filled
with tumors, they’re going to hold a press conference and say
“It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY
US,” and then they’re going to buy all of your stuff
at your estate sale so that they can directly look at the photos
of your vacation instead of reading your insipid emails about