If the phone is infected with malware, it can easily use the granted permissions to access the conversations in popular chat applications such as Messenger or Telegram and steal saved chats that may contain seed phrases, as well as steal browser cookies, phone notes and gallery photos, and other sensitive data.
It’s true, but it’s generally very difficult to happen on android and iphone. These OSs are very well containerised and the apps (normally) don’t interact with each other. However, if the whole OS has a malware, it can definitely cause you trouble. With iOS it’s more difficult than with Android. There have been extreme bounties for security engineers that would be able to plant malware on iPhones but nobody was ever able to extract data from the phones. Most often leaks happen from computers.
Obviously this shouldn’t tell you to feel invincible, on the contrary we should always follow the proper patterns to secure our OSs.