I can agree that iOS devices are more secure, but they are also more limited.
Apple keeps a tight, and in my opinion too tight for my taste control on their devices. You're not allowed to install your own applications, and up until recently, you didn't even have a visible file system. (For all I know that could still be the case). In order to get what I consider base functionality onto a device I would actually use, I would have to jailbreak it, and make it more insecure than regular Android, just to install something as radical as an emulator.
You can bury a 2-inch thick AR-550 safe in 10 meters of concrete, under a mile of sand in the Nevada desert, and have it be the most secure safe in the world, but it doesn't mean anything if you can't get back to your files.
For me, as a general, average Joe who does not have a single shred of important information on my portable devices that can't be immediately eradicated from a potential thief (all banking is NEVER on portable devices), Android provides a level of functionality that I need from my devices. iOS is too locked down, and too deeply embedded into Apple's bullshit to make it worthwhile to me. This is keeping in mind I would only really ever use this all as a tablet that will rarely leave my home.
Now if we want to talk about security, then your mates who bash Android should be wholeheartedly against the concept of laptops. Even OS/X doesn't have the level of sandboxed security as iOS, nevermind Windows. Even with an encrypted file system (which both iOS and Android have, I believe even as default), you still have the same security problems you mentioned on an Android device.
What might be a good idea for a penetration tester who eats sleeps and shits security, might not be a good idea for me. I take my personal security into serious consideration, but I also run the numbers. The likelihood that someone will not only manage to steal the one Android device I ever keep on me (my phone), the absolute best he will have is a token to a couple accounts I can, within a moment's notice, destroy the validity of those tokens, and reset all passwords.