It's also worth noting that the idea that 'Android is essentially linux' is a fallacy. While the structure of the system utilizes the linux kernel, and the drivers for the device themselves are linux-based, Android runs inside of a VM called Dalvik, which is Google's homebrewed Java Virtual Machine.
Many of the software/telephony controls run within Dalvik, not linux. The Android API allows developers access to a large portion of the system controls including calls, mms, texts, emails, internet, and even keypresses (if the user grants the application permission), which, while intended to allow for a broad scope of legitimate applications, also opens up several huge security holes that users should be very aware of. The 'permissions' screen is the only thing between you, and a bad application.