[throwaway613834]

Regarding hostile Wi-Fi: okay, so that means when such an exploit comes out, you can then decide to buy a new phone if your phone is still not receiving updates and if your phone is vulnerable. And I would expect most such exploits to be specific to the phone brand, not the Android/Linux kernel in general. Out of curiosity, do you know of any actual such exploits that remain unpatched in (say) late versions of Android 4?

Regarding someone stealing your phone: I don't understand what this has to do with OS or hardware updates. You can put a PIN on your phone and encrypt it. Perfectly possible on older versions of Android.

Regarding fine-tweaking app permissions: Privacy Guard and XPrivacy do the same thing. Why necessarily update the OS? And in any case, why constantly keep updating the OS past Android 6 where this feature was introduced?