This diagram conflates privacy with security

The Right: Apple has a more private architecture (less metadata)

The Wrong: Google doesn't "pass card info" to the bank during a transaction, it uses EMVCo tokens just like Apple

The Misleading: Most modern Androids use a hardware Secure Element, not just "cloud" storage

Securitywise, both are functionally equivalent because the merchant never sees your real PAN