Pragmatically, though, AOSP isn't relevant to the conversation. OP was comparing the popular smartphone ecosystems that most people are using, and that basicall

Pragmatically, though, AOSP isn't relevant to the conversation. OP was comparing the popular smartphone ecosystems that most people are using, and that basically means the Apple phones and the phones which are running with Google's services. Very few people are actually running AOSP -- they're running Android builds from Samsung or Google which add a lot of binary blobs into the system. Telling people "you could have a more secure phone if you strip out most of the systems that the apps you use your phone for rely on" isn't very helpful.