iOS requires all code to be signed before it can be run. This complicates things a lot when you want to install persistent malware on iOS, as you've not only got to put the files in the right place, you also need to patch the kernel so that on the next reboot it no longer enforces code signature so that it can run your malware.
Here's an example of such an attack. The attackers had an exploit for Safari that allowed them to execute code, but they also needed other exploits to be able to patch the kernel to disable code signature enforcement, effectively "jailbreaking" the device. Without those two extra exploits their malware wouldn't be able to persist.
Android on the other hand allows you to choose whether to allow apps from the Play store or from untrusted sources, however I am not sure whether this check is made only at installation or at runtime. Unless it's the latter the device is still vulnerable to exploits that plant malicious binaries (without involving the installer) since the signature won't be checked on those.
The other issue with Android is that the quality bar on the Play store is much lower than its iOS counterpart. There have been instances where actual malware was published on the Play store.
iOS apps run in a much more restricted sandbox than Android. This can be good or bad as it prevents apps from doing things that can be useful in certain cases, but on the other hand prevents some attacks by malicious apps. For example, in iOS, when you press the home button you can be sure you're going back to the OS's trusted home screen. On Android nothing prevents the previous app from drawing over that screen or even simulating it completely, making you think you're opening another app that you trust (password manager?) while in reality you're still in the malicious app that's just mimicking the home screen and password manager in an attempt to capture your master password.
Finally, while this doesn't apply to your question as you already chose a trusted device, in the iOS world it's much easier to buy a clean device that is guaranteed to receive updates. You can buy it from Apple, a carrier or even a shady phone shop, as long as the device isn't counterfeit it will receive latest updates and the firmware running on there hasn't been tampered with. With Android on the other hand you could have the same hardware device but depending on where you buy it from will run a different firmware (sometimes with built-in spyware from the carrier) and have different update schedules. There's also no easy way to tell those apart (some carrier firmware looks just like the stock one, besides the fact that you'll never get updates and there's probably spyware hidden in there).