It's actually a bizarre thing when anybody gets security right the first time. If Apple happened to do something well, that's a huge credit to Apple. Heck, even Android's experience here is above the baseline for our industry.

Complexity is the bane of Security. Android has to work on a ton of devices with a ton of variation and it has its upsides and downsides. In this case many OEMs ship their own lock screens that update via Play Store and so for example none of my dozen Android devices have this issue - the stock ones are already patched and non stock ones didn't have it in first place. The downside is that the code has to cater to far more variations than something simpleton and that means more probability of security issues.

Given the scale and complexity I would say Google's done an acceptable job at Android security, but I do think they need to be even more serious about it. And it's not like iOS (remember lock screen bugs) or Mac OS X (remember password less logins succeeding?) haven't had their fair share of issues.