I'm not sure why the writer mentions this. (It's probably an excuse to link to another Vice article.) The Android version number in itself isn't a good indicati

I'm not sure why the writer mentions this. (It's probably an excuse to link to another Vice article.) The Android version number in itself isn't a good indication of the phone's vulnerability. Stagefright, for instance, was patched for 4.4 in many phones without an upgrade to the API. An Android phone's security depends on whoever is responsible for maintaining the device's ROM, usually the carrier or phone manufacturer. Samsung, for instance, includes extensions intended to enhance security. Admittedly, for $10 I wouldn't expect much in the way of OTA updates. But except for a few changes to the framework in the way app permissions are handled, the version number isn't the best measure of security.