Our devices don’t usually get hacked, we do. We get led into making mistakes.
We use weak passcodes or passwords, or we re-use passwords. Password re-use is unfortunately common, and the ever-increasing numbers of breached services means our password choices are increasingly widely known.
Breached passwords? See Settings > Passwords > Password Recommendations for details, and for suggestions. Or see https://haveibeenpwned.com/ for a list of the services that have already leaked your account and password pair.
Do enable two-factor authentication on your Apple ID and other accounts critical to you, and do review your Apple ID account settings periodically to ensure your trusted numbers and email are all still valid. Two-factor authentication gives you a last-chance means to prevent access to your account, should your password become known, or become phished.
Do use unique and robust passwords, and preferably use a password manager such as iCloud Keychain. The password manager has the added and subtle benefit of not filling in your credentials on a phishing website, too.
For what Apple recommends around security and privacy, see:
Checklist: If you want to stop sharing with someone whom you previously shared with - Apple Support
Checklist: If you want to make sure no one else can see your location - Apple Support
Checklist: If you want to see if anyone else has access to your device or accounts - Apple Support
Device and Data Access when Personal Safety is At Risk
For how we ourselves—not our devices—get hacked, absolutely see the following write-up:
Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support
Contrary to statements by others, iPad and iPhone can be hacked, and can be exploited, as Apple has directly and explicitly acknowledged. For one recent instance of this, Apple states Apple is aware of a report that this issue may have been actively exploited. That “actively exploited” phrase means that there’s malware around. Malware is fairly rare and is targeted at specific folks—investigative journalists, activists, political dissidents, those with access to wealth or secret or classified data—but does exist. Miscreants do usually start with easier and cheaper approaches—convincing us to hand over our credentials by phishing, for instance is far more commonly encountered. Stay updated to current to reduce this exposure.
And as correctly mentioned above, providing physical access to your device to others is bad.
