In the modern world, every piece of software that isn't cut off from the outside world needs security updates. This isn't the fault of Android developers or anyone else really, it's simply the reality that software (and hardware) is made by humans and humans make mistakes.