How? Web browser is kept up to date via other mechanisms: Firefox for Android, Chrome and even the embedded WebView are all updated via Play Store.

That is, to put nicely, forced-obsolescence FUD. They want to scare you away with words like "unsupported" so they can keep you on their leash.

With the state of software development today, I'd be more worried about how many other holes they've added in the process of fixing something or introducing unwanted new "features"[1].

Here's some interesting statistics to look at and compare...

https://www.cvedetails.com/product/462/Microsoft-Windows-98s... - 30 RCEs in 7 years

https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.... - 276 RCEs in 20 years

https://www.cvedetails.com/product/32238/Microsoft-Windows-1... - 664 RCEs in 8 years

https://www.cvedetails.com/product/102217/Microsoft-Windows-... - 157 RCEs in 2 years

More relevantly:

https://www.cvedetails.com/version-list/1224/19997/1/Google-...

[1] https://news.ycombinator.com/item?id=28449607

Are you claiming that unpatched software is more secure than patched software?

He's claiming with the amount of features being added for every security bug fixed in an update a bunch more are added.

However that ignores the fact that publicly known exploits are more dangerous for the average user than zerodays.

It ignores a whole lot more than that. For instance, are we seriously going to pretend that the threat landscape in the Windows 98 and XP eras was anything like what it is today?

Well, I'm not. If he wants to daily drive Windows 98 because it had fewer documented RCE vulns, godspeed to him---and he probably will be more secure, just by virtue of good ol' security through obscurity---but that is not a reasonable solution for 99.999howevermanyninesyouwant% of computer users today.

The threat was arguably exponentially worse during the XP era - Windows boxes with a huge default attack surface were directly connected with public facing IPs to a 32-bit IP space that could be trivially brute-forced by worms. There's a reason we haven't seen anything as bad as Blaster in the past decade: NAT.

The rate of finding exploits and what the definition of a vulnerability is really what has changed - now the definition of is much broader while at the same time, exploitability has dropped off due to mitigation in modern operating systems, compilers and CPUs. Overall, we get far more exploits, but far less of significance.

Yes, it was not my intention to imply that those old operating systems were fundamentally more secure in some way. You're getting at it here: the space has broadened, and asserting that old software is more secure than new software based solely on documented RCE counts is laughable.