From my understanding is that everything on your phone hard drive is encrypted and cannot be accessed without your PIN, or now 2 form authentication. Not even Apple by their testament can access that data, unless you have it saved in the cloud. This is what both the U.S and U.K gov'ts are fighting because they can't crack into your phone and retrieve whatever data they claim to be relevant to an investigation unlike other phones/computers other companies offer.
Also if I remember correctly I've never heard of an iOS device getting a virus, and I think Apple pulled and no longer allows anti virus programs in the App Store.
Now if your surfing "suspect" sites on safari or other browser your activity can be monitored without the tools that would block such monitoring from happening, however I am still almost 100% certain you cannot get a virus that way either. iOS is very sandboxed
Someone please correct me if any of my info is not accurate as I don't want to give any false or outdated info