To me, it seems Android and derivatives are more rigorously evaluated against vulnerabilities. Whistleblowers and journalists (eg. Vault 7) have even come out over the years to highlight vulnerabilities being exploited by crime groups. That’s not to say that Android and derivatives are perfectly secure, but they do seem close to the mark.