So far the answer is:
Some checks to vet the risk:
- Has been updated in last few months (maintained)
- Developer has resources to debug
- Big Organisation where reputation loss is an issue
- Reviews do not mention security issues
- Doesn't ask for permissions it shouldn't need
If no to any of these, then don't use the app.
Project/developer has reviewers/Large, popular open source app across multiple platforms
- This may be ok but I'm unsure if that works, as it depends if the code is reviewed.
Use ios
- I think Apple does more checks and suitable ones compared to Google. I think Apple has a higher reputation for Security on it's products, app store than Google
Whether the above is fair or not needs clarifying
Searched sources:
“The risk of malicious apps tends to be higher on Android because it’s a more open operating system. It’s incredibly difficult to download an app that isn’t from the Apple App Store on an iOS device, which is one of the benefits of the company’s walled garden approach.
“Malicious mobile apps usually appear innocuous, but run malicious code in the background that can spy on the individual and everything they do on their device,” Schless went on to say.
https://www.trustedreviews.com/news/mobile-news/are-iphones-more-secure-than-android-phones-4205231 Date: 2022
"Android’s open Google Play Store marketplace has far more apps to choose from than on Apple's App Store, but there’s a far greater chance that hackers can make it onto the platform to distribute malware through malicious apps.
On numerous occasions, highly ranked apps with hundreds of thousands of downloads from the Google Play Store have been discovered to contain Android malware.
Android users can also change their settings to allow apps from outside of the Google Play Store. This provides an even greater selection of apps, but opens users to an even greater risk of downloading a malicious app. Apple's secure App Store wins comfortably on this front.
As a side note, make sure to avoid third party app stores; while the Play Store and the App Store have their faults, they're both much safer than the many unofficial app marketplaces elsewhere online."
https://nordvpn.com/blog/ios-vs-android-security/ - Date 2022
"Android operating system Popularity: The Android operating system is hugely popular. This means that developers are constantly building new apps designed to run on the system. That’s good for users ... mostly. The problem comes when hackers create apps designed to infect your mobile devices.
There is an app review process for Google Play. Unfortunately, the process is far less stringent than what developers face when adding apps to Apple’s App Store.
It's easier, then, for malicious apps to sneak onto the Google Play store and easier for users to accidentally install one. One of the main issues is that the end user can go into an Android device and enable the installation of software from unknown sources.
This means that you can install software on the Android device that does not come from the Google PlayStore.
The software—or APK, as it’s called—can be downloaded and installed from a website bypassing the Google PlayStore review."
emphasis added for bold https://us.norton.com/blog/mobile/android-vs-ios-which-is-more-secure# Date 2022
https://www.makeuseof.com/apple-vs-android-which-is-more-secure/ - Date 2022
https://www.howtogeek.com/224096/why-iphones-are-more-secure-than-android-phones/ - Date 2015
Permissions
- I keep being asked for sensor access for no reason I can see on major apps on Google Play that wasn't there as far as I know for ios
You can block the odd permissions later?, ref GraphenOS Sandboxing Google Play etc...
- Not sure this is viable for many users