Firstly the touchbar never ran iOS firmware but bridgeOS a modified version of watchOS.
Which is an iOS derivative, like TVOS.
The Studio Display can't run applications though.
*user installed* applications. There's plenty of resources on the A13 to do more than manage the display's peripherals.
nor does it have an internet connection like WiFi.
It has access to your Mac's thunderbolt bus, and therefore access to whatever internet connection your mac is using.
If you are worried about what the A13 is doing in the background then it's a pointless sense of worry, Hector Martin who reverse enginners Apple's SoCs has said Apple's SoCs have no back doors like Intel's IME or AMD PSP.
We know for a fact that Apple tried to put Apple private networking out of reach for network analysis and firewall tools like Little Snitch etc. We know for a fact that Apple is being influenced, both externally and internally to put pervasive surveillance, under the guise of CSAM detection, into their devices.
The Studio Display is effectively a remotely administrable target display mode iMac, over which the owner has no audit-able control. Some people would consider that to be an inherent vulnerability, and an unnecessary one, given it's a consumer, not professional graphics display, and LG makes a TB display that's just a display with a similar consumer-grade panel.
Yes there was crashing at the start of the Studio Display release, mostly to due with updating the firmware and that was an issue on Apple's server. It has calmed down a lot now(not saying it's completely non-existant).
And again, some would suggest that a monitor should not have automatic firmware updates, rather the product should be finished before it's released to manufacturing, so that the product you own remains the product you bought.