Hacker News Reader

There are many security issues fixed in OTAs.

Marshmallow fixed many of the issues in Lollipop, plus you get security updates.

And (more relevant to the discussion), you can actually disable access to individual permissions regardless of what the app requires (though on apps compiled against older sdks there's no guarantee that they won't crash, but I found that it's not an issue in practice and most apps work just fine even if you disable access to things they supposedly require).

The revamped permission model is enough to make the update worth it IMO and that's not something that can be done via an app update.

Also, ART (the new vm introduced in Lollipop) was still pretty rough in Lollipop.

IIRC it even has some memory leaks ...

It is MUCH better in Marshmallow, so it is definitely worth upgrading because that's another thing where you just need to update the system.