I strongly doubt an iphone app can have sufficient access to the phone to do anything useful.
Maybe if the app bundled an exploit. But that's unlikely to be sustainable.
I think this is an interesting question though, why can we run our own anitivirus on our target computers to check for viruses but not on our own phones.
Because anything with enough privileges to be an antivirus has enough privileges to be a virus, and the mobile OS makers err on the side of caution.
I'd be happy if the OS had bare checksums to warn about unexpected file or permission changes. It might feel like running uMatrix, so maybe not a great idea though.