First, AV bake-offs are a racket that gets security companies to hand over their malware samples or pay to be "excluded," from the bake off. So anyone with advantageous data either gives that up, or pays to be left out of the test. There is nothing honest about their benchmarks or methods. Bake-off companies are scumbags, and this ZDNet reporter got taken.
Second: Hard problem with malware detection on mobile is that there is no privileged role to do analysis from. It's not like you can root the phone and do syscall interception. The best they can do is analysis of apps you can find, and to do automated software analysis at scale is some very interesting work.
However, If you are the target of a custom APT, there isn't a lot anyone can do.
There are a few startups who are doing automated dynamic analysis and working on symbolic execution problems to further this. That the industry has not solved it yet does not make them fraudulent.
Third, Android malware includes:
- fake repackaged apps with adware or spyware. - spyware installed by 3rd party - malware that roots the device - whatever all those dodgy 2FA and password manager apps are. - apps with libraries with known vulnerabilities (think image processing, overflows, etc) - apps that hoover up your data (txts, contacts, browsing, etc) and send it to authors.
The security model of mobile devices (iOS and Android) enforce hard limits on what is possible in terms of security value add by a non-OEM vendor. OEMs are worse than useless, and so app vendors have moved into the game. The threat model apps mitigate is patchy, but it suffices for most consumer and enterprise use cases. However, if you antagonize a government and get targeted custom malware, it would seem naive to think an app vendor is going to protect you.
While I have no remaining affection for any vendors in that space, to call them fraudulent is sensational, if not obnoxious.