A big part of it is extensions, I have a handful of extensions that I use on a regular basis, and Firefox is the only mobile browser that actually supports extensions.

Another part of it is that I just trust Mozilla more. Both in terms of conflicts of interest, and just plain fixing bugs. For example, Safari on iPod touch has been unable to access the microphone for years, even though Safari on iPhones can.

I will concede your point about security. I think that iPhones are probably more secure than Androids. But, I feel that the security of my Android phone is sufficient for my needs.

Extensions don't get enough attention in this discussion. They're the main reason I prefer Firefox on Android. Anything that's missing or not to my liking, I can usually find an extension to provide or change. If something annoyed me enough and there wasn't an existing extension, I could look up the API docs and write one myself.

One big thing is that you can't change the default browser, so any time you click a link you end up on safari. In my experience (I tried iPhone for 2 weeks after my previous phone died, before returning it and switching back to Android) that makes installing a different browser effectively useless.

The rendering engine restriction is less obvious to the average user. And, frankly, if you don't trust Apple with your data then what are you doing using their network stack?

Extensions. On my Android phone I run LineageOS without gapps. I don’t install 3rd party applications, simply because the majority (in my experience) try to abuse your device in spite of limitations put in place by Apple/Google.

Sync of passwords, tabs, history, bookmarks, etc. as far as I know Firefox is the only browser which allows me to run my own sync server.

Is that not all possible with WebKit as the rendering engine? (In other words, doesn't Firefox on iOS already do all that?)

Yes Firefox on iOS does already do that.