Oh, no question about Android being more secure from bad actors - there are most likely multiple parties that could be problematic (Google, device manufacturer, baseband manufacturer, network operator, etc.) while with Apple its just a single such entity.

What I meant is that on Android There is less being done to actively prevent their usage as a self hosting workstation (though some recent "security" changes communig from Google related to running code that does not come from an installed APK might be a reversal of that trend).