its open source and well audited, so no I don’t think they have it backdoored. they get all the info they want from people using google play services at a privileged level, running chrome, and using their other dozen services that come bundled with stock android
Linux can be secured on much deeper levels than windows, by default yes it lacks antivirus but its also much less necessary given the software distribution model of Linux vs windows. But ClamAV is a decent antivirus that I use on my Linux server. Never felt the need for one on my workstation/laptop