I suspect that relative to the vast majority of IoT devices they're quite secure for a use case like that, at least iPhones.

iPhones are not that bad at security.

Anyways, always put any device behind a router/firewall (at least when on wi-fi).

Also, prefer an app that pushes (to a remote server, ...), instead of an app that opens ports.

And don't run other apps on the device.