They take the ads, and distribute them to their users based on user taste that's their secret sauce. Giving user data to advertisers would be giving away their secrets I think.
They sell targeted ads, they do not sell customers' data to advertisers. i.e. Advertisers get to advertise on Google's platforms, but they do not get access to Customer data.
I gather there are some questions around the strength of its app sandboxing as well, but I can't speak to that at all. Perhaps someone better informed will do so.
I'm an Android dev and to me the biggest problem with Android from every aspect (development, security, monetization) is how poorly new versions of Android are supported on devices.
Apple's dig at Android 7 usage vs iOS 10 usage was spot on.
This is not true
1) iOS has had lazy permissions since the very early days e.g. when an app wants to use this microphone then ask the user right then instead of when the app is installed. This feature is still not implemented on all Android devices nor is it as seamless nor is it mandatory.
2) Apple is providing more and more frameworks e.g. CoreML which run only on the device. This means that developers don't have to run their own server side apps to process data.