The problem is not Google providing security fixes
It is and always has been getting them to the phones. If your wife got really lucky with a purchase I guess she got one that is still getting updates for 4.4, but I'll bet that's true for less than 1% of all the phones that were sold with 4.4.
Timeliness is also an issue. If Google issues a 4.4 fix tomorrow and a phone doesn't get it until July, that's a lot of time for hackers to reverse engineer the exploit that was fixed and use it against you.
Biting the hand that feeds IT
