Oh, no question about Android being more secure from bad actors - there are most likely multiple parties that could be problematic (Google, device manufacturer, baseband manufacturer, network operator, etc.) while with Apple its just a single such entity.
What I meant is that on Android There is less being done to actively prevent their usage as a self hosting workstation (though some recent "security" changes communig from Google related to running code that does not come from an installed APK might be a reversal of that trend).
I can imagine as a thought experiment an ASIC or FPGA based phone that implements a very high level application processor, while what we normally call firmware, OS and libraries are implemented in "pure hardware".
(I agree with your sentiment, but somewhat disagree with your apparent conclusion android phones are any better if you're worried about bad actors -- the baseband and DSP from Qualcomm are processors running code we can never touch underlying the entire hardware. Similarly, almost all other computer hardware have separate CPUs inside the main CPU where the mfc. runs their own secret code which cannot be tampered with or even directly seen sometimes)