The best place to put spyware into is closed source unauditable software.

On Windows the entire system and most well known applications are closed source, therefore not trustworthy, but on Android things are not that different: Android makes heavy use of closed source device drivers and so far any attempt to get a completely open system while keeping all the underlying iron useable has failed because most device manufacturers keep their hardware undocumented, save for Google and a few big players under NDA.

The point is that security is an OR: a chain whose strength depend on the weakest link; if one closed blob can contain a keylogger, having just one in an otherwise 100% open phone still makes the phone 100% potentially not secure.