@ianthetechie
I think you have a point, iOS' sandboxing may be more up to snuff.
I've noticed that even on #GrapheneOS, when I log into a single google app, all of the Google apps on that profile have my login information. I have yet to understand how that works or have it explained to me.
But on the other hand, I think Android's sandboxing has gotten a lot better from the last time you used it, perhaps. I've only been daily-driving it since 2020 (and for about a year and a half in 2017-2019), but I've noticed that the number of permissions has steadily increased, as well as more fine-grained control.
One thing I rather like (and don't know if iOS has implemented yet) is that you can grant imprecise location access to an app, only giving them your location within a few street blocks (or really, within a region of a city).
Some Android builds like Graphene also add a sensors permission, as there are libraries out there to do location dead reckoning based on the accl./gyro. sensors alone. (Faux microphone access, too).
I'm not a dev, let alone an iOS dev, but I think a fair amount of iOS' privacy reputation is from privacy-through-obscurity. There's just not a lot of information about what goes on inside apps. Of course, Android has the same problem. They just don't have as much of a reputation for being private.
If I could only convince my friends to never buy android phones from their cell providers. That's freaking insane.