The reason I don't upgrade my windows 7 is because microsoft ethics of being too pushy with windows 10, too much spyware (they track you like crazy), bugs on windows 10.
For me a phone is just used for whatsapp, take picture, call, sms light browsing. No banking stuff. No login to emails. Also, android is a mini version of linux. Exploits in linux are rare compare to windows. Yes there are security issue. But if you take precaution like scanning all apk with virustotal before installing, it helps a lot. Also who ask someone to itchy hand go install unknown apps from Play store? If still scared, disable 3rd party installation. Enable 3rd party installation only when needed.
So updates not important in android for me. 
Cool if it can extend battery life (some updates), bring better camera softwares but most of the time is to fix bugs which we may/may not experience. But security wise, not a real issue unlike windows. That's why people complain that their device lag. My device never lag cause I decide not to update too much. the first 1-5 updates/updates in a year should be fine. After that, I won't bother and up to today, my xperia zr is still smooth. I prefer smooth phone over updates. My mother's mi3 have never been updated (not even once - she doesn't know how and does not want to do it) since coming out of the box. Is still as fast as if it was opened yesterday.