Users "rooting" their Android phones also usually doesn't involve any sort of real exploit either. Android devices don't come with the ability for apps to run as root by default, and can have their firmware flashed to add a means of doing so. Doing this requires that the user unlock their bootloader, which wipes the device and often requires manufacturer authorization. Rooted devices have weakened security by being rooted, but this doesn't affect ordinary non-rooted devices.
Also Android is marginally more useful than an iOS device. I know that it is fancy as a music player and social media apps, but it isn't really what it could be.
Would it? In iOS you can selectively forbid applications from using locations services.
That is the metric I use to determine that the app store security model is bad.
The same is true on Android. I have location services denied on the browser I'm typing this from.