I don't think I'm getting security updates but frankly I haven't checked. I'm not able to open web pages with my version so I think my risk is pretty minimal aside from some exploitable silent SMS or Gmail bug.

The phone works for me, and I did a HUGE amount of research into my options before buying. The Jelly 2 which I was previously unaware of looks to be pretty slick, but for 60 bucks off ebay I don't think you can go wrong. YMMV