Neither of which would be aided by opening the walled garden?

Which isn't to say I don't think there are advantages to Android's model and that of more open package repositories in general, especially for power users. However most of Apple's base is people who don't care about openness or extra repositories, they want their iPhone to work with a minimum of fuss and not have to worry about malware like you do on Android.

The fact that we can only point to a single (XcodeGhost) cromulent exploitation of the Apple App Store stack is a testament to how good Apple is at maintaining the relative security of the iOS ecosystem.

The point is that security is not an inherent or necessarily attainable feature of a walled garden. Some people seem to think that just because Apple approves apps there isn't going to be any security issues. The approval process does prevent some security problems, and has some other features, but mobile security overwhelmingly comes from things like sandboxing.

Perhaps that's the case, but if it is, then it seems clear that Apple's sandbox is far better than Android's as well. Also, approving apps does cull out a range of malware, because it is human- and computer-analyzed before entry. As I said previously, this has its downsides, but it does make it harder to get malware into the iOS App Store. Not impossible, but harder.

Wasn't XcodeGhost a direct result of bypassing Apple's security model?

As far as I know the users didn't. Which is to say that the App Store doesn't provide much more security than e.g. a black list. Androids problems are more than anything having a fragmented ecosystem.

XcodeGhost wouldn't have happened if developers weren't able to disable Gatekeeper and the iCloud hack was done with phishing for security question answers.

http://gawker.com/feds-seized-chicago-mans-computers-in-cele...

The iCloud hack was enabled by the automatic backup feature that despite storing very sensitive information didn't provide adequate security for doing so. If there were actual precedent for Apple caring about their users privacy, there would be outrage over this rather than being trivially dismissed.

That's not relevant at all to the iCloud "hack". It's a cloud service, the whole point is to store data online.

Those accounts were breached because celebs were phished and not because of bruteforcing, as some people were speculating at the time, or some other vulnerability.

Everyone gets phished. Fraud happens. Secret Questions are especially susceptible to phishing attacks. This has been known for about a decade. Apple had not updated the security protocols for iTunes, and in turn App Store and iCloud, for that time. The hack was definitely Apple's fault.

'"In total, the [500] unique iCloud accounts were accessed 3,263 times," the document states.' - http://www.businessinsider.com/fbi-investigation-into-the-fa...

This was a massive failure in Apple's part.

Yes, how can one trust a company's claims about privacy when the seemingly lose no trust over even such a high-profile incident? Celebrities phones has been targeted since at least the T-Mobile Sidekick.