As the other comment mentioned, "Android" is not one thing the same way iOS is. But a reasonable simplification here is:<p>- google phones (pixel line) is the baseline - you'll get there what you'd expect from the upstream docs<p>- copperhead (<a href="https://copperhead.co/android/" rel="nofollow">https://copperhead.co/android/</a>) is going way ahead of that with actual work at kernel level, extended selinux profiles, and more - but you lose the default app market by default (that's ok if you do want to have your own managed device)<p>- every other OEM (whatever you can buy from the local provider) - they're going to be behind by design - they do custom addons on google releases, but no system-level development, so they can be at best as good as google devices (usually worse)<p>So when comparing, decide which level of Android support are you really after. Then there's the threat model: are you worried about random apps that you're going to try, or are you going to use a minimal selection from known companies and you mainly want to stop remote driveby exploitation via ads? Or are you looking for something that will be well protected from seizure and physical access?
The Android world is extremely divided, and it very much depends on which phone you buy. There's this story recently:
<a href="https://www.wired.com/story/android-phones-hide-missed-security-updates-from-you/" rel="nofollow">https://www.wired.com/story/android-phones-hide-missed-secur...</a><p>But there have been other problems in the past, for example that most Android phones are not encrypted by default.
iOS. E.g. <a href="https://techsolidarity.org/resources/basic_security.htm" rel="nofollow">https://techsolidarity.org/resources/basic_security.htm</a>