TLDR: It's safe if you know how to secure your device (don't download random apks, don't give root permission to apps, don't let anyone get physical access to your device.
Sometimes updating your mobile won't even install the necessary security updates (which are needed since vulnerabilities already have been disclosed).
Researcher have found out that quite a lot manufacturers do skip between 1 to 6 android security updates while displaying the most up-to-date version.
I'd say a proper desktop system can be way more secure than a mobile. You have a lot more
control over a desktop system.
Both does of course require a user who is willing to set it up properly.