I would also assume the fact that their vertical integration all the way down to silicon is an advantage here as well.
With the exception of the blobs, everything on Android is auditable.
Meanwhile very little of MacOS or iOS is auditable.
Personally I do not use or trust any of the above, but if forced to choose Android is worlds ahead of iOS in terms of publicly auditable privacy and security.
You cannot form reasonable confidence something is secure unless it can be readily audited by yourself or capable unbiased third parties of your choosing. This means source code availability is a hard requirement for any security claims. Even if you had teams de-compile everything you could never keep up with updates.
Not all open source code is secure, but all secure code is open source.
The bug bounty is pretty hard to actually get access to, there’s still no source outside of the kernel, and the Security Research Devices are really hard to get access to. You have to be someone they’ve heard of, in a country they approve of, you can’t move the device around, and you have to sign your life away to get it for 12* months.