We don't really have a reliable measure of how many attacks are happening on Android and iOS, though. Unlike with a PC, users are much more likely to attribute malware-related problems to 'my phone is just old, I need a new one'. I would attribute this to a mixture of phone commodification (iPhone's appear to be pretty cheap thanks to subsidy plans) and the effects of cloud infrastructure. Users have basically nothing to lose by swapping out phone hardware, because what'll you do, ransom their contact list?