> Microsoft does not allow PC makers to modify Windows. This is why Microsoft is able to push software updates directly to all Windows PCs. Phone makers are all

> Microsoft does not allow PC makers to modify Windows. This is why Microsoft is able to push software updates directly to all Windows PCs. Phone makers are allowed to change Android willy-nilly. This means that the OEM has to check each update and manually integrate it with their version of Android before it can be released. There's no way to keep getting system updates to an Android phone without the manufacturer paying someone to integrate those changes. Yeah, pushing proprietary software make sense, as this enables Microsoft to have total control over their OS. But wasn't the goal with Project Treble to make it easier for manufactures to update their software? But on the other hand they want to sell devices, not maintaining old ones. > Two, the carriers are obsessive about controlling everything. They don't want phones running custom firmware on their networks, and they pressure the manufacturers to prevent that from happening. But, why? What are their gains? > If you want regular updates on exactly how big of a risk you are taking, you can follow Google's security bulletins here: https://source.android.com/security/bulletin https://source.android.com/security/bulletin It's kind of scary to look at this when handling a abandoned device and even more scarier when you realize that they are things that isn't listed here, like 0-day exploits. > This is probably overkill, but back in the day the Stagefright vulnerability made it possible for any website to install software on an unpatched device. Unless you're willing to invest time into confirming that a similar vulnerability does not exist in your current system, the best option is to just assume that there is one. Yep, and this is the reason why you shouldn't use outdated device as daily driver.