it would be possible to bypass the correct accounting of funds. Financial fraud

Well, sure but it’ll be quite difficult to hide a large increase in revenue still. Large unussual transactions generally have to be flagged by banks, so receiving and moving around revenue of sold data from your non-profit wouldn’t be thát easy unless they only allow crypto or cash. Surely it’s possible, but financial fraud on that level is quite difficult and often falls trough sooner or later. Or, the other option is that they don’t earn that much from it making it easy to hide, but that sounds like a lot of effort and potential risk for little gain.

Either way, the financial numbers is just one of the reasons. But trust is never build on one thing, it’s built on the combination of them. With all things I mentioned, I don’t exactly get the feeling it’s all hanging on finacial fraud.

The question is also how to check the traffic on the iPhone, if there are even no monitoring tools there.

Use a network you controll (like your home WiFi) and check in- and outgoing traffic network wide instead of on-device.

You cannot check other peoples stuff all the time, but I’d suggest not sending sensitive information to people you don’t trust as they could leak it (be it on purpose or not). And depending on level of sensitivity, just speak face-to-face in a private place. There is always a form of digital footprint when doing stuff digital. In the end, you should always assume that nothing is 100% safe, and anything cán be hacked. Trusting digital communication to be 100% safe is foolish. Look at situations like the Encrochat debacle for example. The question is more, which risks are worth it in your threat model. For most people, Signal is good enough as the risks it does have aren’t in their threat model at all.