Yup. Android has more apps. Are you going to use all of them? Also,
Android accounts for 79% of the mobile malware last year. Why is this?
Windows Phone apps are sandboxed. In WP7 there was no way for one app to save data in the phone, and another app discover or access that data. Even if the same guy wrote both apps. This keeps a malicious app from finding the credit card number that you entered in another app (Paypal, for example).
In WP8, I have not looked into this, so I'm going on what I can remember of what I've heard, but IIRC it sounds to me like you can share information between apps, but only information that the developer "publishes" to be allowed to be shared. I could be wrong on this, as like I said I haven't looked into it. I'm not developing anything at the moment that would share between apps, so I haven't needed this info.
Android doesn't offer (to my knowledge, anyway) this kind of protection. Besides that, Google doesn't want to isolate things. They want to be able to discover it so that they can use it to sell ads.
In the Windows Phone Store, when I submit an app, it might take a week to get it through the certification process. It is tested for compliance to the certification requirements, tested for malicious code, tested for use of unauthorized APIs, and finally it is human tested.
With Android, as soon as you click the submit button the app is available for download. No testing.
IF a malicious app makes it to the Windows Phone Store (passed certification), as soon as Microsoft learns that it is malicious, it is removed from the store, and the security certificate is revoked. Android can remove an app from the store, too. But then it's up to the user to learn that they have a malicious app, and it is up to them to uninstall it. When Microsoft revokes a security certificate, the app will no longer run on the phones. If you start the app, you will get a dialog saying that the app will be uninstalled. If you tap OK, the app uninstalls. If you tap Cancel, it doesn't uninstall, but neither will it run.
So which one of these two phones would you prefer to use if you do any banking or financial transactions on it?