You should assume there are more zero days in iOS than any engineering team could possibly patch, given the history of other closed source software.
There are a finite number of no-click mechanisms on the iPhone which accepts content from arbitrary actors on the internet. If you disable them, there are precious few ways to get hacked without user interaction.
If you disable iMessage, FaceTime, emails, etc, you still need to worry about the WiFi, Bluetooth, and cellular stacks. Obviously disabling them all turns your smartphone into something less useful.
But I would argue that this isn’t unique to iPhone. There is more highlighting of iPhones because Apple is better at logging indicators of compromise on the device, so the audit trail of attempted/successful infection is better on Apple devices.
In the past, some of the worst CVEs that affected Apple devices were pulled in from upstream open source projects. The core issue is not limited to closed-source projects (although I personally would like to see Apple support more red teamers to bang on their products).