On the other hand, perhaps the hardware/OS designs of iOS and Android devices are fundamentally flawed, when viewed from a security-first perspective.
This is definitely part of the problem. But the fundamental flaw is the departure from simplicity. The solution is to have a processor that is so simple that it cant do more then what you expect, and building the tools to make the unexpected stand out. However, there is a bigger market for a processor with 3 extra layers of root access to ensure your boss can spy on you and Disney&Co really want this to be the norm.
You’re making this out to be far easier than it really is, to the point of being an armchair commentator. People want phones that can call and text and shoot perfect video and play demanding games. All of this necessitates complexity. The average dumbphone is far less complex than an iPhone but it’s obvious which one people want. (And, I should also note that “simplicity” doesn’t necessarily mean “security”: people have found bugs in ridiculously small pieces of code. The rest of your comment of making “the unexpected stand out” is similar in intent to “just find the viruses bro, how hard can it be?”)