Because Android is more secure then you've been led to believe. Google does a decent job of continually hardening the OS and ecosystem and of detecting and counteracting the spread of malware.
If an Android device has access to the store, Google can check and remove malware from the device. Incidentally, these checks are how Google has a pretty comprehensive view of active vulnerabilities and in devices as well as active exploits being used.
The result is if a user does not enable unknown sources and only installs apps from the Play Store (the default and by far the most common configuration) they have a vanishingly small chance of being infected by malware.
Expect the same rate of updates with Treble certified devices.