As tempting as it may be to stop doing updates, that can also get you into trouble. The updates often fix vulnerabilities. It's fairly common for malware to attempt to exploit old vulnerabilities, in hopes of finding a device that hasn't patched it.
I've been happier with the security approach with iOS vs. Android. Perhaps it's changed in recent years, but when installing an app, Android took an all or nothing approach. The install tells you the privileges required by the app, and if you don't like it, your only option was to not install the app. Also, the privileges had very cryptic names, so it was difficult to understand what the app could access.
For iOS, each app gets installed in it's own "sandbox." By default, the app has no access to reach out beyond its own area. When the app attempts to reach out to something, like your photos, it provides a message about what it wants to do in plain understandable language. The user has the option to allow the access or not.
As for the Covid-19 item in the OP, I don't have a big problem with it. To my understanding, it's an infrastructure functionality that could be used if you install an app that will use it. I don't think it's too sinister.
