Which platform would a typical IT guy be more on guard against?
While Windows has been known for decades to be a hot pot for all PC malware, Android phones are much more ubiquitous and personalized, and (as far as I know) aren’t hardened against malware in any way. I mean, it literally takes just two taps to install a rogue apk and that is notwithstanding that most OEM implementations and apps on the Play Store are ad-ridden privacy nightmares by themselves. At least when it comes to Windows, Administrators have greater control over client machines and can put in restrictions. How would someone handling infosec in an organization control security on people’s personal phones?
Ever heard of .bat files? There is no need for admin rights to steal company and user data. All it takes is opening the wrong file. Windows is also terrible about file names, per default extensions are hidden. So you can have a file named “report.pdf.bat” for example and it will show for most users as “report.pdf” with a funny icon. It’s a terrible default setting security wise.
Btw. you’re still comparing a desktop OS with a phone OS. You have to compare Android with iOS. Or Windows with Linux and macOS.