> And that can be blamed back to users.

That's victim blaming. Companies are the ones who shaped this situation and they managed to because each intrinsically acts as a unified entity with a unified goal and a lot of power behind it. People may be many but have little to no individual power, and they don't act in any coordinated fashion.

Users accept this because they can't really imagine it differently. Many of them never saw it working any other way. And phones never had the same kind of flexibility and repairability that PCs offer so people unwittingly assume this is normal and not even give it a second though.

Exactly. Plenty of users care, they're just powerless to do anything about. The OEM's are so big A LOT of people would have to outright boycott them to make any difference, but even then where are the going to go? ALL OEMs do this, so customers really have no choice in the matter.

Honestly, the users are right here - look at the history of this one, there's millions of dated Android devices out there lacking years of security patches, but do they get exploited?

Not in any significant number certainly, there haven't been any wildly successful Android worms like we've seen on Windows even in recent years.

The nature of sitting behind NATs, implementation of modern exploit mitigations in even older versions of Android, the diversity of devices, installation only via a marketplace, sandboxing and being able to rapidly update apps like browsers and email clients that do interact with network services makes those big OS-level exploits almost entirely unimportant.

The Average Joe has limited reason to care even if they stop getting security updates.

In 2020, I’m kind of amazed to hear you say that NAT is a mitigation for security exploits. “NAT is not a firewall” has been a mantra for at least 20 years.

This is just one exploit that can’t be patched by the app level and is dependent on the OEM.

https://threatpost.com/mediatek-bug-actively-exploited-andro...