When the folks at hacker conferences get bored listening to the speakers, they practice hacking into each others' phones. They do it to pass the time.
Nokia says their Windows Phone OSes can't be over-written. Unfortunately for their credibility, that's exactly what updates do. The OS contains a mechanism for over-writing itself. In addition, there are other kinds of malware that don't have to over-write the OS but can run in user space. You can download an app that is vicious to you but that leaves the OS intact. In addition, there has never been a software application of more than a few hundred lines that has gone into production without bugs in it. Not ever. We're talking about millions of lines of code here. There are bugs in it that can be exploited.
It's foolish to think your phone is invulnerable. It isn't, and because we have no power to protect ourselves with third-party tools, we should understand the risks of keeping confidential data on our phones.