Selena Larson for CNN:
More malware is written for Androids than iPhones. On top of that, almost half of the top 50 Android devices didn't have the most recent security updates by the end of 2016, according to Google. Even if your phone is only a year or two out of date, it's vulnerable to some very simple hacks, says Nathan Freitas, a fellow at Harvard's Berkman Center for Internet and Society. "It doesn't take much for your adversary to get into your [Android] device, and that's a big problem."
When Google releases an update to Android, it takes a while to get to consumers, unless you have a Google-branded phone like the Pixel. Carriers and device makers customize Android with different apps and services, and there are at least 11 different versions of Android. Each customized version has to be updated separately by the carrier or device maker before rolling out to consumers.
The whole article is worth reading, but this perfectly explains why I always recommend iPhone over Android for our clients. Android as a platform is still a complete cluster and can't be trusted for basic security.