Take for example iOS and Android. All apps are sandboxed by default. You can't make a program that just steals all of your credentials like you can on desktop Linux. Having security tools means nothing if they aren't being used.

No one is running npm in Android or iOS.

A more apt comparison is vs Windows and macOS.

And Linux offer more than these two with regards to security.

Android is running Linux...