_Maybe_ no viruses is accurate most of the time, but certainly this cannot be extended to no malware. Mobile platforms are 90% malware/spyware.
I’m not saying there haven’t been vulnerabilities in iOS. But those were bugs that Apple tried to close. For desktop operating systems, giving third party applications that ability is a feature not a bug.
Yes I’m including MacOS in that bucket - see Zoom installing a web server on Macs without letting users know.