Use screen locks, app permissions, and avoid rooting/jailbreaking.
Your smartphone typically contains more sensitive information than your laptop: every email, every text message, your banking app, your authentication codes, your location history, your contacts, and your photos. It is connected to the internet continuously and travels everywhere with you. It deserves serious security attention.
Use a strong PIN of at least 6 digits, or better, an alphanumeric passphrase. Biometrics are convenient but use them in addition to a strong PIN, not as a replacement. A 4-digit PIN has only 10,000 possible combinations — easily cracked with automated tools.
Only install apps from official stores (Apple App Store, Google Play) and only from publishers you can verify. App stores perform security reviews, though imperfect ones. Sideloaded apps have no review — you are trusting whatever a website claims about its software. This is a primary malware vector on Android.
Enable remote wipe now, before you need it. On iPhone, use "Find My." On Android, use "Find My Device." If your phone is stolen with your banking app, email, and 2FA codes on it, you need to be able to remotely wipe and lock it within minutes, not after you eventually figure out how.