Desktop linux (and most other desktop OSs for that matter) have utterly terrible security. You are running literally everything under the same user, which has permissions for reading-writing all of your browser caches, ssh configs, home directory from family photo backups to all your documents. A shitty bash script can encrypt whatever it feels like, the old xkcd comic is still true, the only thing an attacker can’t freely do is.. install a video card driver.

Android’s biggest contribution/change is the security model — the old UNIX one is simply way too crude, so instead android runs each application as a new, dynamically created user so that UNIX permissions actually get used properly, to a degree. But that in itself wouldn’t solve the problem of who gets to communicate with whom and who gets to use system resources, so an IPC mechanism is introduced which connects daemons with elevated permissions to ordinary applications. All this tries to cleverly build on plenty of Linux tooling/development (re-use of UNIX permissions, users, process isolation and SELinux), but puts them together in a quite novel way, creating a much bigger difference than what you would find even between Ubuntu and Gentoo.

Also, calling the biggest mobile OS a bad product is quite stupid, it is a stable and well-architected system, with a similar chaos at the top layer as what you can see in the linux distro scene, where every player does their own thing. Blame these vendors, not the core project. GrapheneOS for example for example has none of the bullshit privacy violations of big vendors.

(But I have to agree regarding the Java part, they should have followed the language development much more closely)