Well, on iOS since the only real way to execute code is from their app store, its much harder to attack the client code. Android can not do so, so there needs to be defense in depth to protect against that.