Actually mobile OS usually have better security by default compared with desktop OS. For example, Android offer Application and Privacy sandbox which limit what an application can do.
That's correct. There are not much hacks that happen because of vulnerabilities present in OS but because of negligence of people. There is no way a malware can make it to your mobile unless you download some fishy app or click on some suspicious link. Rather then focusing on security of devices alone, human vigilance is also required in cyber world (or securing bitcoins).
A chain is as strong as it's weakest link, and in security of Bitcoins the weakest link is human.