And yet, A/V hasn't been -- by any reasonable measure -- succesful in stopping malicious software. Maybe the solution is to stop installing software from untrustworthy sources?

My statement can't be taken without context. Stated with more context: "there is no inherent aspect of an operating system that favors A/V as protection from malicious software over any other (like code signing)." In practice, quite the opposite is true. We've proven, through practice, that A/V is a poor solution.

> If the user installs software from untrustworthy sources

This has never been an inherent possibility on mobile operating systems.

Well, you can do it on Android, but they make it hard enough that you really have to know that you want to. There have been isolated instances of this being a source of malicious problem for users, though.