What can a malicious user / attacker do if access is gained to a mobile device (smartphone/tablet) on a company network ?
Ok, I'm answering the question as posed in your comment:
[Is] a compromised mobile device as risky as a compromised computer?
Per @Sean W, a modern smartphone/tablet is a computer, albeit a little one with not that much CPU, that is easy to carry around and prone to being dropped into puddles. Therefore the risk profile is similar (at the very least).
In fact, in many cases I would argue that a smartphone/tablet is much more risky once compromised:
It's small and easily hidden. If connected to AC power in a dark corner, it might go un-noticed for months.
They often have data connectivity via cellular network, allowing an attacker to bypass any corporate security controls.
The mobile OS usually runs on chips (as opposed to hard drives, which can be removed). This makes post-attack analysis much more difficult for Infosec analysts.
An attacker connects to the smartphone, which in turn is connected to the corporate network. End result? The attacker is connected to the corporate network, just as if a desktop computer had been compromised. Almost every mobile device will have enough CPU to run a SSH server for the attacker to connect to.