Honestly, the users are right here - look at the history of this one, there's millions of dated Android devices out there lacking years of security patches, but do they get exploited?

Not in any significant number certainly, there haven't been any wildly successful Android worms like we've seen on Windows even in recent years.

The nature of sitting behind NATs, implementation of modern exploit mitigations in even older versions of Android, the diversity of devices, installation only via a marketplace, sandboxing and being able to rapidly update apps like browsers and email clients that do interact with network services makes those big OS-level exploits almost entirely unimportant.

The Average Joe has limited reason to care even if they stop getting security updates.