Rarely, and malware devs must go through various loops to load a third-party-hosted app/code on a device
Though, the report of apps which dupe users have been there for iOS too,much less, probably due to various factors like: low % marketshare, better vetting process as you said.
How is the app-uploading mechanism different for iOS, Android? Is it too do with the fact that Android has a more open system.