> More iPhones have had malware than Android phones available for purchase in Europe and the US by an order of magnitude

I'm assuming here that you're taking "standard precautions":

1. You get new phones from a trustworthy source, e.g. the official storefront of the relevant company.

2. You buy in person, so that the phone can't be intercepted in transit because some watchlist redirected it based on who you are.

3. You get someone likely to not be on any such watchlist to buy your phone for you (i.e. you hire some kid off the street to go into the store for you, and hand them a wad of cash to pay with.) This is to ensure that, for as long as possible, the phone's MAC address doesn't end up automatically associated with your activities. (It will eventually; but that's why you burn your phones pretty often.)

Under such rules, you won't get any "bonus with purchase" rootkits on the device. The device will only have a rootkit if all such devices in the current market have rootkits.

> Just get a Blackberry, Nokia, Google, or Android One device

You actually cannot buy Android phones in China—even from these brands—which haven't been passed through the hands of a Chinese distributor at the "OEM customization, root-of-trust-not-yet-signed" stage. (Heck, you can't even buy a Nintendo Switch in China without it going through the hands of Tencent.) Every one of these phones has a "Chinese edition" with different firmware, and that edition is the only one available for sale in China.

(How does it work for Android One phones? IIRC, the phones with these editions hit a different Android One firmware-update server, one run by the Chinese government. They still get "stock" Android firmware... in the sense that the only changes are a potential rootkit.)

The reason iPhones are trustable in that situation is that Apple has constrained their infrastructure such that they only have one firmware. That means that any China-specific customizations have to be built into that single global firmware, and activated by software (i.e. by choosing your "Region" in the phone setup.) And that means that your own diplomatic home office can inspect all such customizations using the full resources of your own state counterintelligence apparatus, and then give you the go-ahead (or not) for using the phone with such customizations.

The Chinese Android phone firmware is only distributed within China, so it's much harder to be sure you capture every version of it for security-analysis. And, even if you do, it may not tell you much about what they can do to specific people, as it may just contain "generalized backdoors" (e.g. cellular-carrier-triggered automatic firmware-update push) such that any code that actually spies on people is only pushed to the devices of People of Interest (likely with additional logic to delete itself if the phone leaves the country), such that it's nearly impossible to exfiltrate the device from China back to your own counterintelligence.

-----

But the larger consideration, if we're talking about e.g. populist recruitment into civic-action groups, is that none of those Western Android phone brands are popular in China, compared to Chinese-owned brands. Both because the state controls the advertising (so the Chinese brands get product placement on Chinese TV, and the Western brands do not); and because the Chinese phones are just plain cheaper for the same level of features (which mostly is down to vertical integration and simplified logistics with component manufacturers.) So, sure, you can try to buy one; but it'll be hard to find anyone carrying one. And you can't just rely on a random stranger to have one. Heck, just buying a phone from a Western phone-brand probably puts you on a watch-list.

...other than Apple, because Apple is unavoidably still seen as a fashionable brand in China, despite the Chinese's government's best efforts to quash this sentiment.