The phone has bluetooth and wifi besides the radio for the phone company (GSM, etc). Also it uses a browser, browsers are the most insecured types of applications ever created. The requirements for browsers make them a security risk.
Malware of all forms can enter the phone via the browser, the radio signal, bluetooth, and wifi.
However it looks like Apple will not allow Applications to run unless they been crytographically signed by Apple, so little will get thru unless is a vulnerability in Phone OSX or drivers.
If they do the above, the iPhone will be more resistance to malware than a lot of other phones.
Now days javascript is a big worry at the client side. it has gotten too powerful and hackers are injecting scripts into browsers all the time. There is a particular type of attack where the script can buy or sell all your stock once you login with your browser at your broker, and this occurs without your knoledge and using the browser you are currently using. They use this to bump the value of a particular stock they purchased earlier and bump the price by selling all your stock and using the money to bump the price of the stock they care about.
Many people been burned this way thanks to javascript and injectable web pages. This all occurs in the client side browser. So neither windows, not OSX can do much about it if they provide the ability to execute javascript. The script has your cookies, your session number, etc. It can do what you can do.
TV will play a larger role. 
