iPhone exploit bounty surges to an eye-popping $1.5 million | Ars Technica
The original article is above.
The big problem is that most Android devices never receive Google's patches. Google lacks any direct means to get patches to Android phones. Google doesn't make the phones, it's up to Xiaomi or Samsung, and often the carrier, to do it. The exception is Nexus phones which are made by Google. If I were to get an Android phone, I'd get a a Nexus.