At least Android tells you what permissions an app requires, with Apple you have no way of knowing.

I read a report stating a researcher from a US university tested around 60 (I think it was 56) of the most popular apps from the Apple app store and found all but a handful were harvesting data and sending it off to remote servers. Most apps were encrypting what they sent so he couldn't say what the data was just that some was being sent. I'll try and find a link to the report, I'm sure I've got it bookmarked on one of my computers.

Aren't the problems with Android users installing malware and giving it permission to run rather than some sophisticated exploit?

Another issue is most SD cards are formatted as Fat 32 which I understand doesn't support the assigning of permissions so apps have free reign over anything stored there.