People shouldn't be able to get at the e-mails on your iPhone and on your e-mail provider's servers, but I'm not sure if there are any special protections for e-mall in transit. It might theoretically be vulnerable to being intercepted and to being read like a postcard. We also know that spammers and scammers send e-mails with addresses whch, from an end-user perspective, are cleverly disguised, quite often.
This is why a lot of banks, doctors, and medical facilities will not send information in e-mail. Instead, they will send you notices that there is new information on their Web sites or in their secure portals, and that to see it, you should log in there.
As for e-mail spam from the local grocery store with this week's ads, no crooks can usually be bothered to tamper with it. There just isn't any profit motive for them to do so.