Modern Android is pretty secure

you may choose Android for the specs, guess what, your phone will still get deprecated in 2 years

Google has improved this in the Pixel line, with three years of updates. https://support.google.com/pixelphone/answer/4457705

My original Pixel (2016) received Android 10 last year. That's pretty good.

Pixels are getting better, and Samsung flagships are getting their OS updates for 2-3 years and an additional 2 for security patches. That is.. barely good enough in my eyes.

It would be cool if app stores showed which apps require network access and which don't.

It's a shame Android doesn't allow vpn chaining though, because netguard creates a local vpn connection you can't use it with an actual vpn simultaneously.

I am going to bite. You are just biased. Google adds more APIs because it doesn't have much interest in limiting some features to Play store, because Play is a such small part of their revenue. Apple would benefit if things are only possible through native apps because sweet 30% rent.

That said Google isn't exactly dumb but they aren't well organised in terms of Android - some areas get focus while others not. They even made it harder for external contributers of Android Open Source Project by following Google style monorepo patterns.

Contrast to Apple where mobile OS is their core business and they have to do it well.

Well in my case, I use Debian as my main operating system on my Desktop. Debian is great, but as a classical desktop OS it does not have those cool security things like app sandboxing, permissions management (camera acces etc) and stuff like that. Which makes sense, since mobile Operating Systems were designed from the ground up way later and also seem to move at a faster pace. The fact alone that almostt all ANdroid Apps run in the JVM and are written in memory safe languages is a huge plus that the GNU/Linux family does not have. (Solely speaking about security, I wouldnt want my /bin/sh to be in java)

In my particular case, it suprised me to find out that my android is the most secure device I own. Thus the title (and the intention to wrote this post).

So yeah, misleading title. Kinda. My Bad. Updated the title

That being said, privacy factors are primarily user-choice in that it is the optional apps and programs that compromise privacy, even if the privacy breaches are less-than-voluntary, as seen in the recent clipboard skimming scandal. Making an OS more secure by limiting unauthorized access to information like the clipboard is both more secure and more private.

For me improved security was more synonym to degraded performance.

--most drivers and hardware specifications are proprietary, and probably secret under NDA

--most bootloaders are cryptographically locked and controlled by vendor

--necessary wifi and cellular modem hardware is the same, and are also patent minefields even in the foundational platonic ideals of design, as is mobile graphics hardware

--the modems are subject to regulatory requirements that they be secured from modification by the user/owner of the device

Secure in this context means secure from the user and device owner, which can arguably be for good reason -- think of an ATM kiosk, for example.

So no "tails for phones" yet, but people are trying. Check out postmarketOS, lineageOS, replicant, sailfish. Last I tried things were still kind of science project, like 90's style linux.

A wi-fi only Android tablet that doesn't require proprietary blobs to run vanilla Linux might do.