> But Android also lets you run custom builds

Yes, but that is only one component of a modern phone. Basebands and system bootloaders, among other firmwares, don't receive updates. Those are regularly attacked.

It's good that they do but it's not enough.