I don't really mind; it concerns only updates of core system, not apps. Apps are still updated, so I get updated browser, mail and other apps, that could be attacked; they are not locked to the system. It makes the attack surface vastly smaller.
There are risks to leaving an Android OS out of date, too. That can be mitigated somewhat by keeping Bluetooth and Wi-Fi off when away from home, but it's not foolproof.