The success rate of security apps for blocking Android malware varied wildly — and user ratings in the Google Play store were no guide to effectiveness.