Android is the most popular operating system in the world, has a huge and mostly open application ecosystem, and runs on thousands of different things. When it comes to security and user privacy that is the recipe for a disaster.
Add in the whole fragmentation thing, where there are several different versions of Android still in use and visiting Google's Play Store, all with different levels of system security features and it gets even worse. All Google can do is focus on fighting the problem on its own app store and through one of its own services.
