Either your devices and hub don't need to be exposed to the net (so why are you even using a router connected to the web?), or they do.
If they do, it's because that's how you control them, via the web. If that's the case, it doesn't matter what network your phone is on; command and control is done via the web.
Now, in terms of infecting each other, sure. But the point is to keep my data devices and such separate from my IoT devices. Yes, the whole IoT infrastructure may get infected and need a purge, but my goal is to keep infection of those from getting, say, my banking information. And yes, it assumes that the command and control app is reasonably secure, but that's a whole different issue (and one reason why I would rely on Amazon or Alexa as a hub, and not some random no name company).