Indeed. There is an army of naked celebrities dancing around the internet today because of an "iOS" hole that didn't even involve the device OS at all.
Picking on specific features to announce "Apple is more secure" is very much missing the point.
That said, yeah: I'm not a big fan of Android's security architecture either, though it has been improving rapidly.
This is an important factor, and maybe the fatal flaw in android's carrier relationships. Google is always very fast to push a fix out, but the carriers always drag their feet in getting the fix to the actual devices.
Having a better security architecture works (to stretch the metaphor) like immunization: past a certain adoption level you reach a "herd immunity" state where the marginal benefit to an attacker of a specific flaw drops rapidly to zero even though there are still "old" devices out there in the market in small numbers.
Basically, the market refresh cycle is still at something like 18 months, so even given that OEMs are slow new Android releases are reaching the public in large numbers fairly promptly.
It would be beneficial if carriers could come up with updates faster however. I've seen Verizon drag its feet on more than one occasion, especially with phones that are a generation or two behind.
Are you referring to the year-ago iCloud “hacks” or is there a really surprising twist to the whole XCode Ghost thing that I haven’t heard about? :)
Given the scale and complexity I would say Google's done an acceptable job at Android security, but I do think they need to be even more serious about it. And it's not like iOS (remember lock screen bugs) or Mac OS X (remember password less logins succeeding?) haven't had their fair share of issues.
Well... but Android is a year long (8 years since the first beta) effort backed by Google (55k employees) and companies like Samsung (490k employees). They might spare a few people coming up with a scheme for data encryption that works?
And really, I don't claim it's easy, and I don't claim that I personally could come up with something even halfway resembling Apple's solution. But Android seems, unfortunately, to not even be trying.
Security is hard. Really profoundly hard, not just superficially hard.
And despite the fact that nominally I'd expect to get upvotes for stating what you'd think would be the groupthink consensus, my observation is that in the field, even engineers explicitly tasked with security still often think it's really easy and they're really good at it, so there's no great need for them to budget lots of time for it. This turns out poorly. I do not toss this around lightly because it's become cliche to just fling it around without much care, but there's a lot of real, no-foolin' Dunning-Kruger effect operative in this area.
(Your test for Dunning-Kruger on this matter is: If you're told you need to secure something and you're going to be personally responsible for its security, do you A: Say "Oh, that's easy, I'll 'just'..." followed by pretty much any series of words, or B: get the cold flop sweats, regardless of how easy it may superficially seem?)