In other words we have the apps we like... which is kind of why this article makes me roll my eyes.
There's this thing in economics called rational ignorance.
The upside of finding another app with positive utility is less than the downside of having to wade through hundreds of apps whose security policy comes nowhere close to my personal threshold of acceptability.
The search friction is immense, because Android doesn't allow me to hard code my own "acceptable security" profile, restricting the apps that it shows me to only those apps (at least, not the last time I tried). It would be a short list based on what I've observed in prior dumpster dives.
Want to access my personal contacts in exchange for turning my camera flash into a flashlight? Go fuck yourself.
The utility I'm losing because of my posture of rational ignorance is definitely non-zero, by deliberate Android design. Make it easy for users to impose their own personal security profile, and users will actually start doing it, even the lazy ones who might otherwise fire and forget.
Because the granularity of my control is so outrageously coarse, I have my GPS disabled, I have my data service disabled, I have location services disabled, I have Bluetooth disabled (despite owning a Pebble watch), and 90% of the time I have my Wi-Fi disabled. And I have software installed to warn me when any of my apps try to update. Even Google Play now has to ask permission. If I had a mechanical slide switch like I do on my T500 laptop, I'd also have my microphone and camera electrically disabled when not in active use (the switch on the T500 only controls a few radios).
In a world where the Mozilla phone was viable (never did I suspect this for a second), I'd have switched already.
Android has a user security experience—for a user technical enough to know the difference—of a combination payday loan / taco stand / ripoff currency exchange parked over a filthy storm drain piped through rotting, pre-coup infrastructure into a Zika-infested marshland.
Get a phone with cyanogenmod and privacy guard. You can disallow individual security permissions to an app. Some apps don't like them and crash, but most ask for them but chug along perfectly fine with those permissions disallowed. Privacy guard is a real game changer.