If I replace my current smartphone with a Google Pixel, which would get updates pretty quickly, would I be just as safe from hackers as I would be using an iPhone? This is assuming I don't install shady apps, of course.
If you're wondering what my baseline for security updates is, I have a Google Nexus 6 (good support) and used to use a Samsung Galaxy S III (not very good support IMO).
Thanks in advance.
I will attempt to make this question which could easily be viewed as an "opinion based answer" into something with concrete facts.
I think that, on a whole, the Android ecosystem is a tire fire. If you put every iPhone sold up against every device running Android sold up against each other and compared which platform had more security vulnerabilities, Android would win by a landslide. The reason for this is the variety of form factors and phone manufacturers makes cheap hardware possible, but you have no vetting of your supply chain in many cases. We have seen Android handsets sent with factory installed malware in several cases. Couple this with the fact there is no easy native backup solution which drives people to root their phones and you have an environment where malware can thrive.
Now with that said, if you put a Google Pixel, which was purchased from the manufacturer, not rooted and running the standard ROM (without any carrier bloatware) up against an iPhone I would argue that there is no difference in security between one or the other. Both manufacturers tightly control their supply chain and manufacturing process, as well as put out ROMs or OS's with a security focus in mind.
iOS requires all code to be signed before it can be run. This complicates things a lot when you want to install persistent malware on iOS, as you've not only got to put the files in the right place, you also need to patch the kernel so that on the next reboot it no longer enforces code signature so that it can run your malware.
Here's an example of such an attack. The attackers had an exploit for Safari that allowed them to execute code, but they also needed other exploits to be able to patch the kernel to disable code signature enforcement, effectively "jailbreaking" the device. Without those two extra exploits their malware wouldn't be able to persist.
Android on the other hand allows you to choose whether to allow apps from the Play store or from untrusted sources, however I am not sure whether this check is made only at installation or at runtime. Unless it's the latter the device is still vulnerable to exploits that plant malicious binaries (without involving the installer) since the signature won't be checked on those.
The other issue with Android is that the quality bar on the Play store is much lower than its iOS counterpart. There have been instances where actual malware was published on the Play store.
iOS apps run in a much more restricted sandbox than Android. This can be good or bad as it prevents apps from doing things that can be useful in certain cases, but on the other hand prevents some attacks by malicious apps. For example, in iOS, when you press the home button you can be sure you're going back to the OS's trusted home screen. On Android nothing prevents the previous app from drawing over that screen or even simulating it completely, making you think you're opening another app that you trust (password manager?) while in reality you're still in the malicious app that's just mimicking the home screen and password manager in an attempt to capture your master password.
Finally, while this doesn't apply to your question as you already chose a trusted device, in the iOS world it's much easier to buy a clean device that is guaranteed to receive updates. You can buy it from Apple, a carrier or even a shady phone shop, as long as the device isn't counterfeit it will receive latest updates and the firmware running on there hasn't been tampered with. With Android on the other hand you could have the same hardware device but depending on where you buy it from will run a different firmware (sometimes with built-in spyware from the carrier) and have different update schedules. There's also no easy way to tell those apart (some carrier firmware looks just like the stock one, besides the fact that you'll never get updates and there's probably spyware hidden in there).
