Until recently I had a Nokia E5 which is an old but fully functional smartphone running the Symbian operating system (now obsolete). I find it unlikely that much malware would have ever been written for Symbian and the chances of being infected these days would be close to zero. It was a great phone and I only upgraded because support for WhatsApp ended. Everything else worked very well.
Depends on the person and how the phone is used.
iOS is pretty idiot-proof and secure, at the sake of customisability and freedom.
Android is secure as long as the user doesn't install random APKs from the internet and the manufacturer of the phone keeps the device up-to-date (which is a massive problem with Android at the moment).