This argument comes up every time this topic is discussed. The problem is that you can be as careful as you want, but your information is only as safe as the least common denominator of the people you communicate/know/associate with. If anyone at all that knows you is less careful thank you are, and lets bad software access all data on their devices, then everything they know about you becomes know as well.
Example: So often I get emails sent to me by people I know. They don't say anything that makes sense, and have a link for me to click. To anyone tech savvy, we know that the email did not really originate from our friend/family member. But to less savvy people, they might click the link. That contact email they used to email you became known to some scammer somewhere. What other information did they obtain? If they had access to someone's contact list, they would know your home address, email, phone number, and what else? Photos, videos.... files... etc. Do see my point? They don't need to compromise your device in any way at all to get all that. Just the device of anyone at all that you know that has any of that info about you. I take comfort in knowing who I communicate has an iPhone and is less likely to have malignant software.