I'm a mobile dev and know the iOS ecosystem quite well, i can assure you that iOS APIs are locked and developers can access very little user data without user consent. What an iOS user is vulnerable to is fingerprinting (not too different than what happens on web tbh) and 0days. But given how valuable iOS 0days are it's unlikely they are used inside large scale generic apps and not for targeted attacks. Also it's unlikely that a random company sits on a 0days and uses it against its users.

So ultimately yes, installing an app on iOS is not a trust decision because the dev are very limited in what they can do. The biggest trust decision is toward Apple that might have private secret APIs allowing them to do things developers cannot. That's a possibility, but overall Apple business has never been around ads, big data and users profiling so the chances are not this high.

Actually there are a lot of information that an app can do by default without asking for any permissions. You can check this opensource iOS app: https://github.com/mysk-research/loupe

For instance: check if some apps are installed or not, and a lot of small informations about your device that can fingerprint your phone with 100% accuracy (like the exact time where the phone was setup).