How does it come “clean out of the box” when you literally just said it requires modifications to the settings to improve its privacy?

iOS comes with reasonable privacy defaults and blocks things such as apps running in the background for long time. Going into the settings is the extra-mile that still easier than having to install a cleaner ROM or deal with 3rd party tools.

Samsung and Xiaomi apps are vendor-specific and can be disabled, even without the use of UAD (which works fine, not sure why you’re lying about that).

I'm not lying about anything here, you know as well as I do that many vendors don't allow you to remove all of their Apps and most install permanently running daemons that you can't remove without UAD or other methods.

Android applications have been sandboxed for several versions now.

Yet the sandboxing isn't even comparable. One key aspect of the iOS sandbox is that is not only restricts filesystem access but also executes applications with way less privileges than Android does.

To complement the sandbox iOS apps are forced to use Apple's APIs in order to access user data (eg. Contacts and Photos) which will apply strict restrictions such as allowing you to limit at a system level what photos an application may access. Since all apps are required to be summited to Apple for review (even on Alt Stores) they'll enforce the usage of their APIs making it way harder to bypass restrictions.

Comparatively, on Android, you can install applications from random sources that typically resort to hacks to get around the sandbox restrictions and access more than they should.