I think about phone updates as layers in a stack. At the lowest level of the stack we have software written in literal ROM. As such, it can't be updated withou

I think about phone updates as layers in a stack. At the lowest level of the stack we have software written in literal ROM. As such, it can't be updated without switching out the hardware. For an example of a vulnerability here search for "iPhone Checkm8". No doubt there are examples in the Android ecosystem too. Next layer up there are operating system updates. Unfortunately these are hard to compare across ecosystems as the scope of what an operating system is is poorly defined. Things like the web browser, HTLM rendering engine and SMS app are part of the iOS operating system. But on Android they're just apps and are updated the same as any other app. At the top of the stack we have app updates. Knowing what might contain known unpatched vulnerabilities helps me determine my risk and behaviours to combat it. For example I may not be comfortable running disreputable apps on an unpatched operating system. But on the same phone I may not worry about visiting websites as the browser is up to date. Personally I use web apps as much as possible and native apps as little as possible, so most of the security issues that affect old phones don't concern me.