So - what would you prefer, a slower but secure OS on an older phone, or no updates at all?

Also the "cherrypick" comment is a bit of a dodge - Google already does security patches for older releases (3 years vs. 2).

It would arguably be just as easy to secure one codebase and pare features down for performance.