For one thing, pretty much every Android device made for the Chinese market has had its OS adulterated in some way, at OEM build time, at the behest of the Chinese government. Whereas, Chinese resellers can't really adulterate an iPhone's OS; there's just the one OS image (per model), signed and sealed by Apple, and if China wants to put a rootkit on it, they'd have to convince Apple to put it into that same base-image where any random security researcher (outside of China's reach to quash publication) might find it.
(And yes, either way the phone's baseband will be adulterated by Chinese ISPs at the government's behest, but modern smartphones isolate themselves from their baseband pretty well, so this only matters if you're using your phone as a phone [calling/texting], instead of as a tablet with a data modem.)
(And yes, either way the phone's baseband will be adulterated by Chinese ISPs at the government's behest, but modern smartphones isolate themselves from their baseband pretty well, so this only matters if you're using your phone as a phone [calling/texting], instead of as a tablet with a data modem.)