What kind of security updates actually worry you though? Not trying to sound snarky, but do you install sketchy apps regularly? What are examples of actual threats are you trying to protect against? If you install untrusted apps regularly I could see why, but if not then what attack vector are you worried about? Are you worried about a WiFi attack in a coffee shop for example?

Not the person who you are replying to, but in my case, yes, connecting to a hostile WiFi and someone physically stealing my phone and having access to my entire life is exactly my fear.

Also, being able to fine-tweak app permissions is a huge plus for getting Android 6+ phone.

I've switched to Nexus 5x at the beginning of this month. Current price is around 250€, and I basically gained all the features of flagship models (fast charging, good camera, up to date software, security updates for a year from now etc).

But, up until that point, I refused to install apps that I would be scared of what would happen if they were compromised (so, nothing business-related) and apps that are asking me permissions that I don't want to allow them (as an example, no Facebook app what so ever).

Been that way ever since I became a smartphone user, which, because of my privacy fears and dissatisfaction with current market options didn't happen until like two years ago.

Regarding hostile Wi-Fi: okay, so that means when such an exploit comes out, you can then decide to buy a new phone if your phone is still not receiving updates and if your phone is vulnerable. And I would expect most such exploits to be specific to the phone brand, not the Android/Linux kernel in general. Out of curiosity, do you know of any actual such exploits that remain unpatched in (say) late versions of Android 4?

Regarding someone stealing your phone: I don't understand what this has to do with OS or hardware updates. You can put a PIN on your phone and encrypt it. Perfectly possible on older versions of Android.

Regarding fine-tweaking app permissions: Privacy Guard and XPrivacy do the same thing. Why necessarily update the OS? And in any case, why constantly keep updating the OS past Android 6 where this feature was introduced?

An update of trusted certificate parties would be nice once in a while.

Or fixes that close doors left open.