I believe your right about iOS. But on Android you dont need root to let AV scan apps (an AV can be granted higher permissions, if I??m not mistaken). The AV that I??m using is scanning apps on installation. And yes, there are several viruses for Android. And despite sandboxing - as long as Google Play supports the "good app gone bad" model we still need AV. I favour Android myself, and believe the best protection is reading and understanding app permissions.

I??m not that familiar with iOS. The beigger risks as I see it are iOS users that believe it??s a secure environment, and Apple not revealing vulnerabilities.