Thing is, if the ancient, unmaintained kernel that said Android layer is running atop is vulnerable, your pretty hosed. Securing higher up in the stack won't do

Thing is, if the ancient, unmaintained kernel that said Android layer is running atop is vulnerable, your pretty hosed. Securing higher up in the stack won't do you much good, nor will attempting to containerize proprietary drivers and hoping that that will ensure a secure experience. Running modern kernels and upstreaming out of tree patches is the only reasonable way of supporting & securing these phones and tablets long term in a cost effective, until Google puts their foot down and says "No more custom BSPs", the horrible mess that is Android's security nightmare won't cease.