My impression is that the very first thing a privacy-conscious person would do with a new Android device is install a secure keyboard. Is that not the case? Why should people trust any old software keyboard the company selling it sets as the default?

For a very long time, Apple didn't allow installing custom keyboards. And I would still bet a bit of money that they are more restrictive than the keyboards Android allows.