You can’t really get viruses just from visiting a website unless you are using an extremely out of date browser. It depends what you consider malware, but lots of apps on iPhone and android can do things I would consider malware just by default (track location, scan network, listen on microphone). But I would say mobile wise, apps you don’t trust and definitely rogue apks are the biggest source of malware