You can use iOS, as it is a walled garden, as people say, and it is secure enough for small quantities. You can also use an unrooted Android... same thing, secure enough for small quantities. One can also argue that a rooted Android and an advanced user is a secure combination (something more questionable).

I think current mobile OS's have enough security for mobile wallets. They're made to have just some change, after all. We can address problems by having penetration testing on software releases and continuous support/updates/teams making bug fixes... which we already have.

Don't forget most problems are between the keyboard and the chair, not the keyboard and the monitor