When software is Free, the end-user's relationship is inherited from the developer's relationship to the software [0]. As such, the definition of security is a completely shared one.
When software is not Free, the developer's and end-user's perspective are at odds. For starters, they're likely on opposite sides of a financial transaction [1]. The security of non-Free software is thus defined in terms of the developer's interest. Many desires will still align, like securing against most third-party attackers. But some will certainly not, like the business interests of the company and its partners (including the domestic nation-state).
[0] Indeed, a source of much complaint / usability problem.
[1] I'm certainly not rejecting the idea of trading money for software/services, but highlighting a deep-seated principle agent problem. It'd be really nice to find a way to set up a workable economy around Free software, lest we continue to lose to app stores and "open-washed" webcrapps.
https://news.ycombinator.com/item?id=12957927
True security and privacy cannot be had without free/libre software. It's not a solution in its own right, but it's a necessary step to mitigate issues such as these.
A commenter in the linked thread also mentioned other Android OSes working on hardening.