So far the answer is:

Some checks to vet the risk:
 * Has been updated in last few months (maintained)
 * Developer has resources to debug
 * Big Organisation where reputation loss is an issue
 * Reviews do not mention security issues

If no to any of these, then don't use the app.

Project/developer has reviewers/Large, popular open source app across multiple platforms
 * This may be ok but I'm unsure if that works, as it depends if the code is reviewed.

Use ios
* Need evidence that Apple does more checks and suitable ones compared to Google.  I think Apple has a higher reputation for Security on it's products, app store than Google, whether that is fair or not needs an answer...