Oh really? iOS has page-based executable code hash/signing since at least iOS 2 (2008); Android still doesn't have any runtime code integrity protections.
In a complex system great security takes years of work, it isn't flipped on like a light switch in v1.0. Wasn't the first version of iOS running as the root user?