I don’t know about android, but iOS has some pretty interesting architecture to prevent and sandbox that kind of attack

They put a lot of deliberate work to enable this feature in a way that is hard to exploit

And it really sounds like Google is not mentioning that stance