FWIW and even though that’s not what you implied Android is far from perfect either, just reading https://www.zeropartydata.es/p/localhost-tracking-explained-it-could right now and… even though Google does try, other, arguably not malware (very arguable!) do manage to go through anyway.