What Android phone released in 2013 is still getting security updates of any kind? You make it seem like Google and the manufacturers all update their phones consistently.
In fact, I have a Nexus 7 (2013) nearby, so I know that firsthand.
If Windows desktops have shown us anything, it's that (given NAT) few vulnerabilities are easier and more profitable to attack than a browser.