It is egregious that iOS runs code at all from any kind of message. It's worse than auto-run on Windows, since the only way to turn it off is something called Lockdown Mode, which turns off other stuff as well.