Based on this question.
Why are there more research papers on Android malware than iOS malware?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Android has 87% market share. Even if attackers manage to infect small percent, that is still lot of devices they can cover in small time frame they get before the vulnerability is fixed or malware is detected.
Android suffers from infamous fragmentation problem due to which most android devices lose security updates after 3 - 4 years and forever become vulnerable to new vulnerabilities. This gives attackers large timeframe to spread malwares through various channels until they are caught by Google Play Store and anti-malware agencies. So more malwares are built for android devices.
Android allows flashing of custom images which can used to gain root access. This is useful for researchers to disable some SELinux policies, customise kernel, attach debugger with the malware, dump its memory and analyse post exploitation behaviour of malware in real environment.
Qualcomm, Samsung and MediaTek release platform tools for their SoCs which can reflash even hard-bricked devices. This lowers research cost and if experiments go wrong, there's a safe state to go back to without requiring specialised hardware programmers. Using these tools, the process can also be automated to test malware samples in different OS versions and in generic system images.
I can think of a few reasons:
Android is open source
That makes easier to analyze its workings and identify vulnerable code.
It's more used
More people use Android than iOS, so the resulting malware would infect more people.
Emulators are more accessible
Android emulators are more accessible. That makes testing different Android versions way easier.
Sideload is very easy
As Robert properly commented, it's easy to send someone a random APK and they will probably install.
There are hundreds of custom ROMs available, and some of them disable security features. They are mostly intended for development use, but some people use it as default ROM.
It's easier and more profitable to write malware for Android, thus there is more research on, and more research papers about Android malware compared to iOS.
To break down why malware is more common for Android:
Android allows developers more freedoms(that can also be utilized maliciously), a few things worth mentioning:
Android also has a problem with security updates. There are X numbers of vendors running Y versions of android at any time, most often with their own customizations to the OS, and manufacturer support ranging anywhere from 1-4 years on average. I've previously purchased Android tablets that don't let you update the OS at all, ever. Compare this to Apple longer support and consistent updates across a simplified line up of devices. It's easy to forget how integral software + hardware is in a security discussion - it's not just about the software and it's patches.
Android holds a commanding lead in market share, even with the average income of iPhone owners markedly higher, the sheer number of Android users means a successful exploit can reach millions more people, and thus, turn millions more in profit.
I've often seen that Android being open source is a reason it's less secure - I personally reject that theory. In general, large, well supported open source projects are just as or more secure than their closed source counterparts. Further, companies like Apple and Microsoft expect that their source code is revealed in it's entirety from the start of their security planning. They know it's nearly impossible to hide indefinitely, and it's better to not rely on "hidden source code" to be secure.
One last tidbit I'd like to add, there may be more malware for Android, but that doesn't mean iPhone is inherently safer. It's simply what the (black) market dictates.
As well as the malware being more common, the open source nature of the project allow more security researchers to review and analyze the code, which also increases the amount of research papers about Android compared to iOS. Thanks @Nosajimiki for making this point clear/widening the perspective for this answer
The other answers focus on the fact that Android is fragmented, more accessible and has a larger market share. While this is all very true, there are a few other things that make it much more interesting for malware:
The fact that Android is fragmented is definitely true, but most malware doesn't even try to obtain root privileges. Because it is so fragmented, it actually takes more effort to create an exploit that would reliably work on multiple Android devices than on iOS. This is one of the reasons why a zero-click exploit for Android is now worth more than iOS.
If you want to attack iOS, you will have to exploit either known or unknown vulnerabilities which requires a significant investment. This does happen, but it's usually as a targeted attack rather than just for making some money. Add to this that iOS updates are delivered to end-users in a very short time period and the number of supported iPhones for new iOS versions is also impressive. This makes using known vulnerabilities much less interesting.
It is the simple consequence of the law of supply and demand:
Android (and all OEM-provided versions) is a much more vulnerable OS than iOS.
Then there is a much larger market of weapons targeting Android than iOS. The ratio of malware (of any kind), last time I checked (10 years ago), was 10⁴:1 in one full year. This ratio is not proportional to market share nor to the impact size a virus could have.
This huge advantage in the attack surface of Android implies that there is much more work to make to improve Android security than iOS security and that there are many more products to sell on the security market.
Then the research on securing Android is a profitable and wide field (is this field infinite is still an open question from my point of view). I would say a kind of bottomless well.