Mostly in the form of OEM-installed data collection/"analytics", but yeah.
Probably a lot of people install sketchy apps from Google Play too. Apple's not immune but it's a lot harder, you basically have to be pissing off a government. If you are then it's still entirely possible you're 0-click owned without ever noticing.