The typical concerns are about 3rd party tracking, malware, and information disclosure.
Apps can gather and transmit an incredible amount of data about the user and the phone. All this data might expose the company and its users to 3rd party analysis. There was a recent case where a secret military base was discovered because personnel were using the same running app, which tracked their runs around the base using GPS.
Without any controls over what's installed, it is possible for apps to contain or be a gateway for malware. Restricting apps to approved, well-known apps helps to prevent this problem.
When using any device for mixed purposes (personal/business) it can be difficult for people to keep its use consistent, which can lead to inappropriate sharing of information. It can also lead to company data being saved in personal accounts (their Apple ID/iCloud storage), which you have no control over, even if the person leaves your company.
Is all this bad? That's not for us to tell. You need to perform a risk assessment to determine if the risks are acceptable and the cost/benefit of allowing this freedom.
"But people could use their personal phone to do all this, too!" Yes, that's right. Restricting phone use helps to prevent inadvertent issues (mistakes) or "drift" in the separation of personal/business, which can cause problems for the company. How much of a benefit this is to you is a matter for your risk assessment.
Personally, I prefer to enforce different devices for different purposes so that people can remember what they are using the device for. And maybe one shouldn't post that whiteboard with future plans on Instagram...
I would also promote the idea of permitting certain personal apps on company devices so that their use can be risk assessed. Like Spotify. The risk is likely low, but the benefit in employee experience will be high. And the Security Dept doesn't become the "Department of 'No'". The goal is always to say "yes", but to do so responsibly.
