Leave it to fanbois to talk about something they don't get. I'm looking at you, otacon. If Android was so full of holes, nobody would used it, because nobody intentionally wants to buy a system that is going to be infected from day one. You'd understand that with a minimum of applied logic.
Any OS is as secure as the user allows it. By default Android has all the necessary stops in place. Don't forget, this is about malware targeting devices, not malware installed on devices. The simple fact that after so many years we have yet to encounter any significant "epidemic" out there on Android phones is a testament that many can try, but so far none has succeeded.
OTOH, if one intentionally start removing the default stops, it's all on him/her.