What more could I have done to secure my iPhone and iPad?
It really depends on what you're protecting, and what you're protecting it against. If you're worried about some phone thief grabbing your family photos, securing the devices is really easy. If you're worried about protecting classified info from the Chinese government, securing them adequately is really really hard.
Turning on airplane mode and removing the SIMs will do a good job of securing them against network attack and/or snooping, but there's still the issue of someone getting physical and/or visual access to the device(s). There are some things you can do to harden them, mostly having to do with passcode security:

Set a secure (complex) passcode. Without a passcode, your devices are open to anyone with physical access to them. With a basic (4-digit) passcode, you have reasonable protection. A 6-digit passcode is better, and a custom (longer) passcode (numeric or alpha) is even better.

Set the devices up to require that passcode. In Settings &gt; Touch ID &amp; Passcode, set it to require passcode immediately, erase data after 10 failed attempts (you should make a backup, but leave it at home), then switch off Voice Dial and all of the Allow Access When Locked options.
I'd also turn off Touch ID. It avoids the possibility of someone spying on you entering your passcode, but if you're serious about security there's too many ways for someone to get &amp; fake your fingerprint. Troy Hunt discusses some of the tradeoffs here.

Also, in Settings &gt; Display &amp; Brightness, turn on Auto-Lock after 1 minute.

Oh, and don't jailbreak your devices. If you've broken the iOS security model, don't expect it to remain intact against others.


So with the above (and turning off all network connections), your devices are pretty well locked down. But are they secure enough? As I said at the beginning, it really depends on the value of what you're protecting, the capabilities of whoever you're protecting it against, and how much they're willing to do to get your data. Can they compel to you to unlock the devices? Can they spy on you as you enter your passcode? Can they swap your devices for fakes that just capture the passcode you enter, and then use that to unlock the real devices? Can they confiscate the devices and then wait to see if a vulnerability is eventually discovered that'll let them unlock the devices? Is it possible they know of a non-public vulnerability? If the answer to any of those questions was &quot;yes&quot; (or even &quot;maybe&quot;), your devices aren't secure enough.
But there's another aspect to consider: from the point of view of your IT department, it may simply not be worth the trouble to work out the detailed risk &amp; threat assessment, make sure they haven't forgotten any necessary steps to secure the devices (did I forget anything above? Maybe, maybe not), etc. From their point of view it's much easier and much safer to just say &quot;no, don't take them&quot;.