iPhone have content blockers but those are paid applications. Mullvad (the paid VPN) has a custom DNS to filter that kind of shit (ads, trackers, gambling, social media, etc.) and it's so effective that I can't read Facebook or Twitter anymore. Or you have custom DNS like https://quad9.net/ but I'm not sure if they do block ads.
Yes, on Android. From my own investigations, it appears to have a really bad malware problem despite it's claims of scanning for malware, especially for the free distributions of paid apps from the Google Play Store, which constitutes piracy and copyright infringement raising ethical issues.
This once again shows how the EU is toothless. making laws just for a show while allowing big tech to circumvent them while waving a big fat finger to the EU's face.