I have an Android 4.4 phone, and while it has worked acceptably for me right now as I am self-employed, if I were working for a company that required me to have access to sensitive customer data, having a phone that still received security updates would be a hard requirement.
..which reminds me I have some more work to do, given the recent publication of https://source.android.com/security/bulletin/2016-07-01.html
I understand that we talk about this sort of thing quite a bit, but I can't imagine actually doing it myself. My phone is just supposed to work for me so I can get my real work done and have time to enjoy outside of it. I'm not supposed to work for it.
I'd guess you have to really enjoy working on that sort of thing, but then again you called it "work to do", so I'm not sure.