Note: Linux phones are notoriously insecure (source) but please correct me if you know better

A few points

Operating systems like Android and ChromeOS have full system mandatory access control, every process from the init process is strictly confined.

Android uses SELinux for mandatory access control as per their own docs

As part of the Android security model, Android uses Security-Enhanced Linux (SELinux) to enforce mandatory access control (MAC) over all processes, even processes running with root/superuser privileges (Linux capabilities)

As for ChromeOS, it's built upon Linux and that blurred line between Chrome and Linux is being completely removed --> hello Linux And ChromeOS aka LACROS

To make matters worse, some system daemons are not designed with permission control in mind at all. For example, PulseAudio does not have any concept of audio in or out permission.

PulseAudio is due to be replaced by PipeWire which

was designed with a powerful security model that makes interacting with audio and video devices from containerized applications easy.

https://github.com/mikeroyal/PipeWire-Guide

There's also Wayland, which is being written to replace X11. It has better security

Wayland isolates the input and output of every window, achieving confidentiality, integrity and availability for both.

While it's true that many apps aren't designed with security in mind, flatpak and snap packages have their portals API. The author did mention that they are underutilized, but that's slowly changing.

Additionally, immutable distros (nixOS, Fedora silverblue) do exist, which make it quite hard for unauthorised applications to modify root partitions since they are mounted as read-only. Mobile NixOS is still in its infancy, but it's being worked on.

In conclusion, security on linux isn't hopeless, there are solutions being worked on, and improvements in linux phones will benefit all desktop users, unlike distros like Android and ChromeOS that build custom solutions that aren't contributed back to the community.