It's really paradoxical that a closed source O/S is a pro-privacy option vs. Linux-based Android of all things.

As to the fact that you're at Apple's mercy, that's true, but I don't see how that's particularly different with Android and Google, the only difference being with Android you often don't get their latest software update. ;)

And yes, definitely a paradox but I think the primary reason is that people tend to think of Android as being a Google product, when it isn't, Google just bought it. If you use pure Android on a rooted device you could probably secure it pretty effectively, except that software updates then become more complicated, plus the process of rooting a phone, while not as complex as jailbreaking an iOS device, is quite challenging and above what the vast, vast majority of users are willing to do.