Part of your problem here is that you've framed your question around this concept of 'regular people' as if such a thing exists and if it did, that there is significant overlap in their interests. You like to play Pok?mon, I play Fallout and will miss out on the Pipboy app when I play Fallout 4 on my Xbox. Is that enough to switch?
Another question is over whether people are always able to make the best decision for themselves even if the market wasn't skewed.
For instance, few people like to think about their personal security. They have the perfectly reasonable expectation that devices wouldn't be sold insecure. They also expect that the data they send through the internet is not being stored and collated for use by a third party for its own advantage and we both know that both these expectations were violated from day one with Android.
There are two reasons Android simply isn't adequate from a security point of view. Firstly, it is old technology adapted for a use model that was never imagined at the time and incorporating a technology - JavaScript - which is notorious for being a security disaster area. I was not surprised when the Stagefright bug was uncovered, because it is only the latest of several serious security flaws found in code not intended for purpose. I hope all your Android toting friends are using the Zimperium app to check their devices aren't open to malware. Android is no more secure than Windows was in the late noughties and it will take a similar titanic effort to straighten it out. In fairness, Google, Samsung and LG have committed themselves to the same monthly update schedule Microsoft took so much flack for, but it's much harder to get those updates on to phones generally.
The second reason Android will never be secure is Google itself is an advertising company, their whole business is based upon the assumption that you have no legitimate claim of ownership on information about you. It simply isn't in Google's interest to respect your privacy; at very best, Google's interests can be said to be indifferent to your own.
It is a simple historical fact the Google have often had to improve security on Android after public outcry. For instance, they only made device encryption the default after the BBC ran a story on the Tesco Hudl tablet leaving files readable after a hard reset. Similarly, Google are facing anti-trust proceedings after it was found that they were skewing search results to favour their own services. Are you sure you want this organisation to have your personal data and that of your friends? Are your sure you want to your Pok?mon app that much?
To my mind their are only two viable smartphone options: iOS and Windows Mobile, and that's because the day to day functionality (Windows phones do so much out of the box.) and security of my mobile computing life is too important to sacrifice for convenience or the sake of following the herd.
This isn't going to be popular on Windows Central, I know that there are many who hate Google... you may fire at will.
I may ask you to back that bus up a little bit. Two claims that may need to be adjusted with some additional context:
1.
Stagefright: At its HEIGHT the media ran with the story that over 1 billion devices were effected. In truth, stagefreight had the ability to impact less than .08% of devices at the time that it was discovered and no single device has ever been impacted in the wild. All devices running Android 4.0 were systemically protected by other mechanisms within Android for all known attacks that this vulnerability had available. The devices at the highest risk were Android phones running API level 10 Gingerbread 2.3.3 to 2.3.7 with more than .5GB RAM and Tablets/Google TV and other devices on API levels 11 through 13 Honeycomb with more than 1GB of RAM and being MMS capable through cellular radios. You can imagine the tiny number of devices that this is comprised of. The security updates rolling in September and October eliminated the first step of the risk so that unknown implementations of this attack can not expose undiscovered vulnerabilities that could make it through the other 6 layers of defense against this attack.
2.
Privacy: Most users of things that connect to the internet are aware of the fact that they are giving their information to some company or another. The question about privacy, from a public perception, typically generates fear of that information being SHARED. In most cases, people think of data being bought/sold/traded, etc. Google has a unique model in AdSense with which your data, stuff about you, never makes it to the advertiser. Instead, the ad is placed by Google and the revenue is shared with the site, etc. at the expense of the advertiser and all of this happens with your data never leaving Google's side of the equation. This is unknown to most users, but Google takes another step and forbids themselves from sharing your data with ANY third party (unless required to do so by law, such as via a VALID warrant) without your explicit permission to share specific data with that specific third party. They give you complete control over this. This is different from the approach that say, Apple takes, where they give themselves permission to share your anonymized data with whomever they choose. To the end user, this is more or less the same thing - personal details about you, connected to your identity, never make it outside of the company you shared it with. BUT, Apple is trading data and Google is not. This is the opposite of the public perception. That said, Microsoft gives itself permission to share data within their network of Microsoft controlled affiliates, subsidiaries and vendors. This SOUNDS like the worst of all three, but in reality it just means that they outsource some of their big data analysis, etc. I have not heard of a situation in which Microsoft has abused user privacy other than the Yahoo partnership fiasco from 2013 but users of all systems should remember that their Outlook account belongs to Microsoft, their gmail belongs to Google and their Facebook belongs to Facebook, etc. On a similar note, ever word typed in this forum belongs to Mobile Nations.
I don't really think that any mobile OS is inherently more secure that another, I do think some users are more inherently secure than others. That said, Google has a LOT of FUD being spread about them and most of it is being spread by hypocritical mouthpieces of companies that actually violate the tenants for which they want to accuse Google of violating. Yes, Google's business is data mining and turning that data into two things: 1. useful features and 2. (most important) dollars. Apple and Microsoft are in the same business with the same tools and they're doing the exact same two things with data - they just have a different way of describing it and a different twist on the feature-set.