>Maybe arbitrary programs on a phone is akin to a random .exe on Windows 95

No, it isn't because there is already sandboxing.

>that can provide direct or indirect access to almost all personal and financial information.

Windows 95 computers also used to have web browsers and bank information. The risk has not progressed