This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices g

This isn't a good metric unfortunately. A much more realistic metric is % of devices with unpatched CVEs. With iOS updates and Windows updates, most devices get their vulnerabilities patched (assuming the vendor addresses it at all), unless specific action is taken not to update them. However, most android devices are not updated past a few minor Android versions, and once the carrier no longer provides patches, there is often no way for a normal user to patch the OS at all. So Windows could theoretically have 100x the number of vulnerabilities over time, but if they are fixed and autopatched, then those systems can still be more secure than a system that doesn't get patches past the first year.