You can fix security bugs without forcing your users to upgrade entire OS.

?

Security on even older phones is so good most non-tech oriented people think that phone viruses are a myth

That's not really true. There are regular browser vulnerabilities, for example.

On Android, browsers are updated separately, outside the OS update cycle. The Android users have the current Chrome, Firefox or whatever they are using, without regard to their OS version.

I don't doubt that there are many vulnerabilities. However, public perception so far is that it doesn't matter, as little in terms of major viruses have actually happened.

Security updates should be independent of all the other crap they lump in with them.