> most malware comes directly via Google's ecosystem carried by ads.

Google's own Play Store is filled with outright malware too, no ads needed. The idea that Google has to control what people are allowed to install on their phones isn't really for the protection of anyone except Google.