I recently got a free Android phone, and would also never let it near anything that could extract money from me, and am conscious of the information it can disclose.

Sorry, legitimate Android app developers! I would like to pay you for the things you create, but your neighborhood is too sketchy for me to visit.

That's pretty ridiculous, we're talking about credit card purchases here, which can be trivially charged back, not bitcoin private keys... if you've worked with sensitive info on a Windows box though, that's probably a much worse off environment.

The comment above didn't mention what type of card they are using nor in what country they live. Regarding Windows, in the times of Windows XP there were no "telemetry".

Using a smartphone for banking is really dangerous because banks often use a phone as a second factor and compromising the phone gives full access to your bank account. And many phones do not get security updates.

I'm not referring to Windows as poor for telemetry, but it's tremendously easier to get malware that takes over your whole system on Windows than any other platform - consider the fact that downloading and running unsigned executables is an extremely common practice - even as a fairly security conscious person I do it regularly on Windows. Add to that the fact that Windows completely lacks sandboxing and you pretty much get a pile of malware on your machine unless you really know what you're doing - and even then I've seen fairly technical people click next past a "bonus ask.com toolbar" in an installer.

Even with a regular bank account in most of the world at least, it's tightly regulated and you're only liable for a small portion of the loss - on a credit card, generally nothing at all.

Even without OS security updates, generally browsers and other internet connected software gets security updates regularly, I'd trust a new user on Android far more than Windows because clicking an ad would not have a risk of getting them infected system wide without jumping through some serious hoops and involving a few exploits. On Windows that's one Run button press away.

Is there a reason to believe that mobile ecosystem is more unsafe than the desktop ecosystem?

I would argue it the other way round. On mobile (Android or iOS), apps have much fewer permissions compared to on desktop. e.g., one app can't look into the data of the other app. On desktop, it is possible to write a binary which steals user cookies (e.g., https://github.com/rash2kool/cookie_stealer). For all purposes, the binary would be legitimate, and no antivirus or OS APIs would mark the binary as bad.

However, on mobile, one app can't peek into the private data of the other app. So, the Uber app can't peek into my browser cookies.

I think using a smartphone for banking is very dangerous:

- banks often use phone (for example, SMS) as a second factor for authentication, for example to confirm transactions. Compromising a phone thereforer provides full access to your account. Some banks even allow to perform payments by sending SMS without logging in.

- many phones do not receive security updates in time. And those updates close only public vulnerabilities.

- while Android has good permission system, many apps have a very wide set of permissions, including permission to read or send SMS messages, or permission to use accessibility functions, so compromising such an app can also be enough.