You just shot your own argument against his point in the foot. Thousands of people doesn't even make up a percentage point of the users of Android. Most people on Android use Google Play because it's sufficient against the threats that they need to it be sufficient against. Most people are okay with the risk/reward ratios that come with using commercial software because they then don't have to think about it. Signal provides a nearly turnkey level of protection above and beyond standard messaging in an easy enough format for most people to use.
Android could undoubtedly be stronger in this regard, and in permission control, firewall, ad blocking etc, but it's not going to happen.
Apps wouldn't be so bad if they were actually sandboxed properly, but yeah, they suck.
I was interested in Copperhead OS as an alternative, but it seems to have fallen into a greed induced mess.