It doesn't and it won't. Why should it? If it did, then it would be as open to the malware as what is being virtualized. That's insane.
Virtualization does not introduce vulnerability to malware. In fact it is a way of managing/isolating sessions that brings with it enhanced security.
The reason iOS and Android are vulnerable is that they are a classic OS design, with both having roots in Unix with common core architectures. Androids higher malware rate is that they are much more open source and fragmented across manufacturers. Apple controls it with walled-garden. But both are inherently unsecure.