The bootloader of your phone (if locked) is one of the most secure parts. It's very hard to get into a modern phones bootloader. In contrast, finding an exploit in a running phone is a lot more feasible.

If a vulnerability was abused to get into your running phone, it will persist until the phone reboots, and the bootloader verifies the core parts of the operating system at startup. In order to persist past a reboot, malware like that would need a vulnerability in the bootloader, or a bypass for its integrity checks.

Alongside that, any background services ("daemons") that got stuck or became slow over time are forced to restart. Operating system updates can be applied, and working memory is cleared.

In general, it's just good advice to just reboot your phone once in a while. There's no harm in doing so.