I don't disagree with your conclusions about managed platforms being better for enduser security, but for what it's worth a vast majority of botnet payloads are being loaded by drive by exploits, email based infections are generally rather targeted these days because spray and pray email infections typically get caught in spam filters.

While the bulk of the drive bys come from plugins that don't exist on your classic walled garden (ios) webkit is far from invulnerable. ios (and others) are quite resistant, but so was ASLR at one point - malware rises to the occasion.