Also a good point, but how would you propose that we measure 'security'? Is an Android phone that hasn't received a carrier update in 8 months "secure"? How abo

Also a good point, but how would you propose that we measure 'security'? Is an Android phone that hasn't received a carrier update in 8 months "secure"? How about a home server running an ancient distro which long since stopped receiving package updates? The phone is probably a bigger concern at scale, but I have seen plenty of families with dusty "photo storage/backup" boxes that their family's resident IT person set up and networked when they were in high school.