I'd argue the opposite. It's this dismissive attitude about a vulnerability affecting 1M+ accounts that is the problem in some sectors of the security industry.

I'd argue the opposite. It's this dismissive attitude about a vulnerability affecting 1M+ accounts that is the problem in some sectors of the security industry. You're drawing arbitrary lines around what Google is responsible for and what the user is responsible for, and ultimately blaming the user for having an "older device". But guess what? This problem doesn't affect iOS products anywhere nearly as much, even though there are hundreds of millions of older devices in use. That's because Apple took an approach that allowed them to ensure devices stay up to date. Google didn't. And that's as important to security as is UX design and all the other often-dismissed factors that go into achieving successful security outcomes.