Let's not derail this, kk. Question was about android malware types and defense.
I think the main question was about the alternative options your friend might have to avoid being watched according to his claims. Nevertheless, since android is an open source and it allows for third party apps to be downloaded, this makes android valnurable to various types of malware.
http://www.forbes.com/sites/gordonkelly/2014/03/24/report-97-of-mobile-malware-is-on-android-this-is-the-easy-way-you-stay-safe/And how to defend yourself against the growing threats of android malwares It doesn't take a bright mind to figure it out.
1- Always have an AV and anti malware on your mobilephone, I know they aren't effective 100%, but at least they do their job.
2- Never download third party apps. Avoid downloading apps from random websites.
3- Examine the permissions of the apps on your phone, there are some apps for android that require no permissions but allow you to examine the permissions given to all the installed apps, this helps to detect an app with suspicious permissions.
https://play.google.com/store/apps/details?id=com.ovmobile.appopslauncherI think this paper is also informative.
http://www.ijcsit.com/docs/Volume%205/vol5issue02/ijcsit20140502216.pdf This is what I think are the main steps to defend yourself against android malwares, I claim no experience, I'm just an android user since 2012.
Signed: Axon