How secure is Android?

There's endless discussion of more or less quality about each of these questions, and I suspect anyone can get any answer they want to hear. Using Android without incident since version 2.3, and currently on 8 and 9, my distilled wisdom is:

1. Virtually all reported exploits are from installing malware with bad apps from bad sources. Google's Play Store is about as safe as Apple's App Store, and third party security is not needed if that is the sole source of apps.

2. Android, unlike Apple, permits app install from other sources. If "side loading" apps as APKs or installing from anywhere but Play Store, use a third party security app to scan for and block malware, replicating what the stores do. I currently use BitDefender free for automatic operation at very low resource use, but watch laboratory rankings every year - no brand loyalty is ever deserved.

3. I only really worry about leaving the phone someplace and am much less worried about a hacked Pattern than about never seeing it again. I use a lockscreen message: "REWARD if found: extra-email[at]domain" which is forwarded to my real email. For dead battery, I also keep a small post-it with the Reward message stuck on the back inside the protective case (I worry most of all about dropping the phone, tending to be once or twice a year).

4.  Should make oneself familiar with Google's device finding system.

5. Others differ, but I don't personally like or trust biometric security so don't enable fingerprint or face unlocks.