Not sure about the linux distro being safe part. Linux desktop distros are also riddled with vulnerabilities that no one bothered to look. This is along with the bad design of the desktop in the first place as there're no isolation between apps and so forth.

Example: https://arstechnica.com/security/2016/12/fedora-and-ubuntu-0...

Android on the other hand, has isolation mechanism built in as the central thesis of its apps system. Additionally, it also has some additional layers on top.

Unfortunately since nothing gets updated it maybe all moot, but I don't think somehow Linux distros are more secure.

Well, GNU/Linux distro are usually patched. Main ones for pretty much all known vulns. Tons of Android systems are not patched. I don't think any of those is secure against anybody motivated enough (and I'm not even thinking about a 3-letter agency, but any hacker competent enough!)

Arguably the security model of main desktop OSes is bad enough so that they are also easy to penetrate. That should not make us dismiss the problem of the way too many unmaintained Android systems!

The Dalvik system that runs on top does indeed put apps into their own named processes with restricted access etc, quite a good idea imho!

But the entire system as a whole doesn't get updates to lower parts. E.g. Updating your java app doesn't solve the problems in the underlying C libraries the system uses. We're at the mercy of vendors for that, if ever.

That's a library vulnerability, nothing to do with bad design of the desktop.