Well, the open framework of permissions for Android does allow for malware to be written, and code test routines can test for malicious intent and trap for it, but it'll be governed by defined rules. A malicious developer, given understanding of the test tool, can contrive code that bypasses those checks and thereby exploiting a vulnerability.
Microsoft moves further by having experienced developers peer review the code and can better judge what the code is actually doing. There may be cases where a developer will be able to create a malicious app using the framework/dev tools provided by Microsoft, but there's very little chance of that passing through the certification checks and being sent to the wild. To date, there have been no cases of malicious WP7 for WP8 apps being released through the Store.
There's plenty of low quality apps of course, but that's a whole different story...