You bring up some really good points - you’re never going to be more secure than using stuff that you’ve put together and coded. And even then you are still yourself vulnerable to making mistakes, ignorance of a topic, etc so there is still risk of course.

Ultimately I left android because the vulns for the consumer grade stuff were more frequent than Apples.

It’s just not feasible for me (and I’m assuming many others) to take the time and patience to setup custom images and hardware and everything else to get to the 99.99% secure point. The 80-90% I have now over what I had on end user android builds is just fine