Is there a reason to believe that mobile ecosystem is more unsafe than the desktop ecosystem?

I would argue it the other way round. On mobile (Android or iOS), apps have much fewer permissions compared to on desktop. e.g., one app can't look into the data of the other app. On desktop, it is possible to write a binary which steals user cookies (e.g., https://github.com/rash2kool/cookie_stealer). For all purposes, the binary would be legitimate, and no antivirus or OS APIs would mark the binary as bad.

However, on mobile, one app can't peek into the private data of the other app. So, the Uber app can't peek into my browser cookies.