Android and PCs are an apples and oranges comparison.<p>On PC code can execute and do arbitrary things (Window 8 "apps" excluded). The only security protections on PCs is either ring 0 or not ring 0. It doesn't matter if you're Windows, Linux, or OS X the very nature of x86/x86-64 is either "root or not root." Virtualisation might change that equation one day, but containers still aren't commonplace day to day.<p>So on PC application run away is a legitimate threat. You trust Adobe Reader, but if a website tricks Adobe Reader into executing an attacker's code then Adobe Reader can do anything it has access to on that PC (which is everything in user-mode, which is a lot). So you use AV as a stop gap to try and catch some of these (although its effectiveness is questionable, things like Click-To-Play on browser plugins, automatic updates, NoScript/Request Policy, and EMET are more reliable).<p>Android also has ring 0/not-ring 0, but unlike PC very little runs in ring 0 anyway, and every user-mode application also has additional security restrictions placed on it. So for example downloading and executing code, while possible, it is far harder to escape even the application's own context (since most of it is JavaScript in a WebKit component, not bytecode). So most code exploits don't execute "arbitrary" code, they execute very restrictive code.<p>Plus then you have OS enforced app restrictions (manifest permissions). If an app gets hijacked by a bad guy, if the bad guy wants more access than the original author then they need to request it and that is user visible (might set off alarm bells). Even if they just keep the old permissions that may restrict what they can do.<p>Lastly the way Android is designed in general means certain common issues are mitigated, for example:<p>- Cryto-Blackmail (encrypt your stuff then blackmail you into paying or it will be deleted), most apps cannot access other app's content, most content is backed up automatically, and if they can access other app's content they may not get enough access to overwrite it.<p>- Sending spam or DDoS botnet: Android kills background processes. Android throttles processes using up too many resources.<p>- Stealing passwords: It is very hard for one app to "spy" on another app (rooted phones not withstanding). So if you enter your password on Chrome, you can reasonably be assured that the Space Invaders app didn't "see" it (unlike PC, where one user mode process can trivially spy on another).