If you are talking about Android keyboard, is https://github.com/helium314/openboard not a good option?
Source available if only requeated is not enough, the big benefit is when any one can at any point check the code on a whim. Not ask for a permit and wait until the company decides(if they decide or just leave you hanging) to give you a copy of the code.
Besides the fact that even in this scenario, malicious code can be hidden.
To answer the “big question”, “Why Android even allows this” I asume you are taking about the Android versions that are coded to allow this. In this case it is because , well, are coded like this. Why did Google coded their Android version like this? Profit.
Apple, doesn’t code ios like this cuz it is not their big revenue.
I am not sure Google or Apple are the hero in this story. Insinuating Apple does it out of the goodness of their hearts is naive.
Personally I use BitWarden with a unique pain in the ass password that I have written it down somewhere.
From there I can get back into everything.