It doesn’t take a jail broken phone, just apps installed through the enterprise deployment system. It is a 5% vector, but under certain circumstances it can happen.
Yes, it does. . . the enterprise installers STILL go through Apple's CURATION. As do vertical solution Apps. They DO NOT ALLOW UN-CURATED APPS ON THE iOS SYSTEM. That is what a "walled-garden" is all about. You are really stretching.
Let's grant that it were true that apps could be deployed through the enterprise deployment system. . . do you SERIOUSLY think an IT department would allow a maliciously crafted app to be downloaded to allow the theft of their data? Really????
Just because the apps are "Self signed and certificated" from a corporation doesn't mean they are just willy-nilly loaded onto iOS devices. They do get some curation. And, as I said, no company IT is going to download malicious apps to their employee's phones.