You get what you pay for.
The data are from the National Institute of Standards and Technology’s National Vulnerability Database. Vulnerabilities are defined as software errors that can be directly used by a hacker to gain access to a system or network. According to Statista:
Android had 523 such vulnerabilities in 2016, far ahead of 161 for iOS. 2015 was a completely different story. Back then, Android had only 125 vulnerabilities while iOS had 387.
Lots more stats at Statista