It wouldn't even be hard to achieve security: (1) sandboxing, (2) permissions system, (3) database of bad app signatures, (4) heuristics based monitoring. Most of this is already in place. There's no excuse except money and power.
Because that's worked so well for PCs?
PCs don't have sandboxing or permissions.
That’s a pretty broad statement, and sure, you can get an OS with neither, but broadly speaking modern operating systems that people use do have sandboxing and permissions.
In fact, I am using a PC right now that is working pretty well.
Which specific heuristics based monitoring do you use? Is it tied to a for profit company?