Google may be marginally better at updating their own devices, but they regularly suggest Play Protect as how to stay safe from malware, a piece of software that ranks dead last (literally zero stars) for detection rate on AV-TEST[1]. It's the sort of "here's a green check mark, just trust us" security approach that has carried McAfee for decades.
I was hoping we'd hear some changes with the new security lead at Android, but so far its been more of the same.
How to stay safe from Android malware: buy a phone with regular security updates. Don't install random APK's from Russian boards. Simple.
Android AV is useless bloat. It runs in its own sandbox just like every other app. Play Protect is the only one with privileges to actually do something.
I was hoping we'd hear some changes with the new security lead at Android, but so far its been more of the same.
[1] https://www.av-test.org/en/antivirus/mobile-devices/