Also that Android only gained the ability to enforce iOS-style fine-grained app permissions (prompting on first use for access to camera, location, etc., instead of a blanket grant at install time) one major version ago, which means that many if not most users can't actually get the benefit without buying a newer phone.

I gather there are some questions around the strength of its app sandboxing as well, but I can't speak to that at all. Perhaps someone better informed will do so.

Those permissions are also opt-in for devs at the moment (by choosing certain OS versions at build time you can still use the old permissions system).

I'm an Android dev and to me the biggest problem with Android from every aspect (development, security, monetization) is how poorly new versions of Android are supported on devices.

Apple's dig at Android 7 usage vs iOS 10 usage was spot on.