I'm sure "visit a site and get exploited" happens, but... I haven't actually heard of a single concrete case outside of nation-state attacks.

What's more baffling is that I also haven't heard of any Android malware that does this, despite most phones out there having several publicly known exploits and many phones not receiving any updates.

I can't really explain it except "social engineering like this works so well and is so much simpler that nobody bothers anymore".