Sadly I can't recommended any Android phone as a first. But only because of the app store loose app policy. A newby, even an experienced user can easily become infected with malware.
Also Google needs to review app permissions. I use humidtrack on my Pixel, but it asks for permissions to the camera, camera location(precise and background access), read and write shared storage, full network, and 11 other permissions.
I also have a iPhone for work. The same app has no permissions other than to use Bluetooth.
Come on Google?
Welcome to Android Central! I'll disagree with you about it being easy to get infected. Malware has to be installed by the user, so as long as the user has some degree of common sense, the risk of malware is low. Here are my usual recommendations:
1. Avoid shady websites that deal with things like porn, gambling, and "free" (aka pirated) apps/music/movies.
2. Never ever tap on a link that appears in a popup while browsing, especially if they're warning you that your phone is infected -- they're just trying to scare you into installing some bogus "antivirus" app that is probably malicious itself.
3. Only install apps from well-established app sources like Google Play Store or Amazon Appstore. Read a bunch of app reviews before installing an app to look for any complaints about adware or suspected malware.
4. Turn on Google Play Protect features in
Settings>Google>Security (or in the Play Store settings). This allows Google to periodically scan your phone's apps to look for malware.
5. Turn off "Unknown Sources" in
Settings>Security (or in Special App Access on newer phones). This prevents any app that wasn't obtained from Google Play Store from being installed (which could include malicious apps that are inadvertently downloaded).
Unnecessary permissions don't always mean a developer is up to no good -- most of the time, it's due to laziness. You mention a good habit of checking an app's permissions before deciding to install it, so if it asks for permissions that seem unnecessary, that can be a good criterion not to install it. But if you know the developer is legit, that's a good reason to contact them and ask them about why those permissions exist -- there could be important reasons why they're there on Android and not iPhone.