It is true. This is a function of Exchange and Active Sync. It doesn't work with other mail servers and only deletes your Exchange info.
AFAIK, true for BB's also, although I think in the BB case, RIM can remote cleanse any BB using the Blackberry Internet Server (not sure, never tried it).
As I understand it, an unauthorized iTunes will not allow communication with a passworded iPhone, but it does apparently let the user restore it, e.g. making it work for them if they stole it, but not giving them your data (again, have not tested this).
So you would want to password the phone and (in case you're concerned about a known person trying to gain access to your info), you want to make sure that the authorized computers are all password protected (no auto login, screen saver lock, etc).
For a jailbroken iPhone, you probably want to make sure that you have a strong password assigned to the root account so that a thief could not SSH into the phone.
That should be reasonably good, although in addition to the (current) lack of the ability to remote cleanse/disable the phone or set the password feature to cleanse the phone after repeated failures, the iPhone also typically doesn't meet stringent security demands because it lacks disk encryption. Lots of IT staff seem to be letting it slide, though....
