My biggest question is how long they can stay at a handful if they become popular. The increased burden of security patches alone would likely turn that handful into a small army.

Security through obscurity is often mocked (for good reason), but it actually does work in cases like this as long as you don't reach Android's scale.