Considering how absolutely dreadful iOS has been when it comes to CVEs allowing arbitrary code executions with kernel level privileges, I don't really think anyone gets to talk about iOS being "secure" by default. Secure for your grandfather maybe. There's a reason Zerodium values iOS zero days less than Android ones too [0], which is quite telling of the amount of them they already have in stock. See also Pegasus, which literally had multiple no-interaction RCEs for iPhones through iMessage (because Apple keeps parsing files through horribly vulnerable parsers). [1]
Apple gets to pretend that iOS is secure because they control the app store, which is the only official point of entry, and iOS is closed source.
[0] https://zerodium.com/program.html
[1] https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage...