I think you are ignoring how much Android security has improved in the past 3-4 years.

Core libraries (where historically the biggest security bugs have been found, see for example stagefreight) plus all core applications (e.g. Web browser, email client) are now updated from the store.