From trivial to apply app and OS updates to code signing and disabled sideloading, the mobile platforms (either one) make it really much harder to fall prey than on desktop OSes, by design. Malware authors have to hit a homerun on 0-days to even begin to get a foothold on the mobile OSes† these days.

† on properly updated devices such as the Apple ones as well as Nexus+Pixel. Probably this is where some form of vertical integration starts to really matter in practice.