Can you be more specific on what you consider "widespread" vs "rare"?
There are widely available tools for exploiting iPhones. These are available to low level law enforcement, border guards, etc. They're often abused. The same goes for remote exploits. Apple and Google have succeeded in making the exploits expensive, but not much success in stopping them for more than short periods of time. Perhaps they'll start having more success, but so far they haven't. Making the cost of developing the exploits more expensive does not change that the usage is widespread in many dozens of countries. The remote exploits are not only used in targeted attacks against a tiny subset of people. They're often broadly deployed on publicly accessible websites.
I don't think this constitutes as widespread at least in impact, but there's been times where malicious apps have made it on the App store and used to steal cryptocurrency.
I don't really agree with your framing.
I disagree with corporations marketing misrepresenting their security capabilities to sell more devices and services. Apple and Google are much better at security than most tech companies but definitely nowhere near as successful as Apple's marketing portrays it.
I agree but I really have no idea how to fix this.
If that's the case, then many of their public statements about this are extraordinarily dishonest. There are widespread exploits targeting Safari, Chrome, iOS and Android. These are not only rare attacks targeting people heavily sought out by governments, etc. They do not have nearly as much visibility into it as they make it seem.