Well, yes, security updates can be important. However, since I run a home-built Android distribution on the thing I can keep it up to date with the most egregious bugs (SurfaceFlinger bug etc.). This leads to the odd situation where my oldish phone is more secure than my wife's much newer Xperia C3 running a stock 4.4.4 distribution.

..which reminds me I have some more work to do, given the recent publication of https://source.android.com/security/bulletin/2016-07-01.html

Home-built as in you merge in bug fixes yourself?

I understand that we talk about this sort of thing quite a bit, but I can't imagine actually doing it myself. My phone is just supposed to work for me so I can get my real work done and have time to enjoy outside of it. I'm not supposed to work for it.

I'd guess you have to really enjoy working on that sort of thing, but then again you called it "work to do", so I'm not sure.

Yes, I partly merge them myself, sometimes it is done by others. The results are shared through the XDA forum where the Defy used to have a lively community. That community has mostly disappeared, but some die-hards - like me - still try to keep the thing up to date, if only to show the futility of planned obsolescence and locked bootloaders...

Working at such an employer, they'd also likely require remote-wipe capability on the phone. That was the case for my job. I opted to carry two phones, instead (one completely provided and paid for by my employer).