I'm a mobile dev and know the iOS ecosystem quite well, i can assure you that iOS APIs are locked and developers can access very little user data without user consent. What an iOS user is vulnerable to is fingerprinting (not too different than what happens on web tbh) and 0days. But given how valuable iOS 0days are it's unlikely they are used inside large scale generic apps and not for targeted attacks. Also it's unlikely that a random company sits on a 0days and uses it against its users.

So ultimately yes, installing an app on iOS is not a trust decision because the dev are very limited in what they can do. The biggest trust decision is toward Apple that might have private secret APIs allowing them to do things developers cannot. That's a possibility, but overall Apple business has never been around ads, big data and users profiling so the chances are not this high.