Some do, some don't. Those who do have not yet found anything nefarious but it certainly is possible for some bad apple to end up in the pile of code which make

Some do, some don't. Those who do have not yet found anything nefarious but it certainly is possible for some bad apple to end up in the pile of code which makes up an Android distribution. The difference between the paradigms is that it is possible to tailor an Android distribution to your needs (which includes leaving out Google-proprietary code) where it is not possible to do so for iOS and its derivatives. Where (AOSP-based) Android users can 'trust but verify' (a contradictio in terminis given that those who trust should not feel the need to verify) iOS users are left nothing but 'trust'. This trust has been broken several times when it comes to the PRC.