"the security is only breached if you have been too slack to...

"the security is only breached if you have been too slack to install quality anti virus software"

I hope you don't really believe that! Anti-virus software:
1) Only protects your from known exploits and a small set of identified behaviours. You are totally exposed to new exploits until an update is released.
2) Are powerless to fix devices that are already corrupted.
3) Can do nothing to protect your personal information held on external servers.
4) Can do nothing to protect users who just grant the ludicrous permissions requested by "free" apps!

http://www.cs.rutgers.edu/~iftode/hotmobile10.pdf
http://www.pcworld.com/article/2953...-a-simple-mms-message-or-multimedia-file.html
https://www.appthority.com/enterprise-mobile-threats/2016/08/31/trident-a-rare-and-powerful-exploit/
https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf

The last one is quite technical, but the first 2-3 pages contain enough information to keep you awake at night. The following are quotes from the analysis.

"As soon as the targeted victim clicks the link, the attack occurs silently, with no indication to the user or device administrators that anything has occurred or that any new processes are running".

"It steals the victim’s contact list and GPS location, as well as personal, Wi-Fi, and router passwords stored on the device"
​

"the surveillance capabilities include remotely accessing text messages, iMessages, calls, emails, logs, and

more from apps including Gmail, Facebook, Skype, WhatsApp, Viber, Facetime, Calendar, Line, Mail.Ru, WeChat, Surespot, Tango, Telegram, and others"

This exploit is now known and closed. But it was open from "iOS 7, which was released in 2013".

​