Yeah But...
do they not think it beyong the wit/skill of the malware creators to see what version of Android the device is running and use known vunerabilities for that version to install the payloads?
The sooner the networks start blocking really old devices from accssing web pages etc the better. Perhaps that is the trigger that will get the device makers to up their game and release updates?
Now that I think about it, Nah, it won't. The device makers are mostly operating at the bottom end of the market. They's sooner sell you a new phone than update the old one therefore consigning the old one to the landfill site that everyone seems to have in their home ( a drawer/cupboard specifically for junk that will never be used again).