When it comes to iPhones, it’s not a shouldn’t, it’s a can’t.
The way iOS limits background process means you can’t. I develop for iOS apps for a living.
There’s still you should never under any circumstances allow unsupported devices to be exposed to the internet or any way. Because that’s how we get bot nets causing DDOS attacks.
Except this whole article doesn’t apply to android. Android AFAIK has 0 announced plans to do this. So why is it a concern?