It is normal and friendly to offer Wi-Fi to customers, visitors, contractors and staff for their personal phones, and the easy way to do it is to share the same password everyone uses. The catch is that everything connecting with that password joins the same network as the machines that run the business - the till, the office computers, the shared storage, the devices holding customer records and financial information. A network is a shared space, and devices on it can, under the right conditions, see and reach one another. Putting a stream of unknown visitor phones and personal laptops on the same network as the business's own systems mixes the trusted and the untrusted in one pool.
The risk is not that every guest is a threat - almost none are - but that you have no idea what state their devices are in. A visitor's phone might be carrying something harmful without its owner knowing; a contractor's laptop might be poorly maintained; a personal device might have been compromised elsewhere. On a flat network where everything is together, a problem on one device has a path to the others, and the business's own systems are sitting in the same room as every casual, unmanaged device that has ever been given the password. It also means the password to the network the business runs on has been handed out widely and written on a chalkboard, which is its own quiet weakness.
The fix is built into most modern routers and costs nothing but a few minutes: a guest network. This is a separate Wi-Fi network, with its own name and its own password, that provides internet access but is walled off from the main network and the devices on it. Visitors, customers and personal phones go on the guest network and get exactly what they need - a connection to the internet - without ever touching the network the business's own equipment uses. The business devices stay on the main network, with a password that is not shared beyond the people who actually need it.
Setting it up is usually a matter of enabling guest access in the router's settings, giving it a name and a password, and using that for everyone who is not a core part of the business. It is worth choosing a strong, separate password for the main network at the same time, and changing the guest password periodically since it travels widely. This one piece of separation - trusted devices here, everyone else there - is among the highest-value, lowest-effort security steps a small business can take, and the equipment to do it is very likely already sitting on the shelf where the internet comes in.