The thing about security updates:
Sure, ditching your phone when it doesn't get any more updates is the safest thing, but I can't bring myself to do it for environmental reasons.
My phone runs Android 6, which currently has a 1% market share.
Who designs and deploys new malware that can only affect 1% of devices, most of which are probably secondary phones that only connect via Wifi behind a NAT by now? I'm not too worried about that.
