See how much an exploit for iPhone vs Android will run you in the open market.
Also how fast a discovered security hole will be patched and distributed to the fleet between the two systems.
Most Android phones will never get a patch, some will get it 6 - 12 months later and very few within the month.
Also one is run by an advertising company.
I can’t imagine any system of influence running an exposed ssh without some further protection from connection abuse like fail2ban.