How do you qualify Android as the worst security-shipping product? Is it mainly due to the lack of sound update mechanisms? Because conceptually, Android's mod

How do you qualify Android as the worst security-shipping product? Is it mainly due to the lack of sound update mechanisms? Because conceptually, Android's model (each application is its own Unix user) seems pretty good