iPhones have basically no real attack vector, since all software available for the thing is curated by Apple to look for malware. To put it in a way a Linux user would appreciate, unless you're the kind of person who runs Arch or Gentoo, you're not going to be running unsigned code on the phone. All the software on the device has been approved by Apple before it was ever given a signature and allowed to be downloaded.

A number of older models can be deliberately jailbroken to run unsigned code, but you have to be one of those enthusiasts I just mentioned. She also maybe could in theory join a beta test group on TestFlight (the pre-release public testing platform) that would run malware that hadn't been submitted to Apple, but that's very unlikely.

This is a device state agencies are using and their enemies are trying to hack into. Some script kiddie targeting a wide range of people like your Mom is not going to be hacked. What is more likely to happen is she falls for a phishing attempt and people get ahold of her credit cards or personal data by pretending to be Amazon, Comcast, etc.