One downside to the security model in popular mobile OSes is that once someone does gain superuser access there's really nothing the user can do short of rebuilding the device since they often don't have it themselves.
Also Android is marginally more useful than an iOS device. I know that it is fancy as a music player and social media apps, but it isn't really what it could be.
Would it? In iOS you can selectively forbid applications from using locations services.
That is the metric I use to determine that the app store security model is bad.
The same is true on Android. I have location services denied on the browser I'm typing this from.
Users "rooting" their Android phones also usually doesn't involve any sort of real exploit either. Android devices don't come with the ability for apps to run as root by default, and can have their firmware flashed to add a means of doing so. Doing this requires that the user unlock their bootloader, which wipes the device and often requires manufacturer authorization. Rooted devices have weakened security by being rooted, but this doesn't affect ordinary non-rooted devices.
Because getting your exact location extracted and send to marketing firms and government contractors is worse than quite a few trojans you could get on your local computer by executing random and even malicious code.
It is time that security experts get honest about this and that "experts" lower their voice a bit.
In my experience, security expert generally are honest about this and should, if anything, raise their voices more.
There is a technically correct argument that a locked down environment hinders the execution of malicious code, but for overall security, especially privacy and illegal data access, the current "security" solutions for smartphones perform very badly.