Earlier quoted context omitted.
Having spent some time reading Qualcomm/broadcom/mediatek patches, I don't really consider any Android phone to be secure against anything more than script kiddies. If you want security, you go iPhone or no-phone. There are 'security by obscurity' benefits to having a minor brand though, simply because the attacker will probably have to adapt the exploit rather than use it straight off the shelf.
Please elaborate more about security. What can be so seriously wrong on non-rooted device?
A few years back, Google got annoyed with them for clearly having nobody review any of the code, and they tidied up the worst loopholes (making it harder for apps to directly communicate with device drivers and native vendor extensions), but there are loads left for anyone happy to spend some time looking.
I would consider Android phones reasonably secure if you're browsing the web, but for there to be very little security from a malicious app.
Google contents that "there can't be any malicious apps because we scan all the code in the store", but we all know that scanning for evil code is snakeoil and it's easy to make an app which only reveals it's evil functions when not running on a "NEXUS 5 (emulated)" as googles scanner uses.
Broadcom isn't as bad, but they mistakenly open sourced a lot of their firmware years ago, and still use most of that code today, so finding bugs is far easier considering their hardware doesn't do ASLR, DEP, stack canaries, or any modern code protection method.