As this shows, no OS is immune from bugs and security flaws that might get abused.
And it also shows that Apple's approach is superior to Android's, as they've managed to get a fix out to all devices capable of running the current version, and even without the fix it's still quite difficult to get a malicious app out to users unless they've jail broken the device.
Meanwhile in Android land, fast swathes of devices are running insecure versions of the OS and will never be updated because even if they're capable of supporting a current version of Android it's impossible for Google to force OTA patches out due to all the crapware and skins and other nonsense that OEMs put on top of android in an attempt to make their android device somehow different or better than every other android device. Meanwhile the phone retailers would rather you buy a new device rather than be able to patch your current one to a more up to date and secure version of android.