The bigger issue is that millions and millions of Android devices are in use that don't have and will not have the current security updates. Google ought to create a path for the owners to update instead of accusing the OEM's of failure.

Quite a few years ago, before it was common knowledge, I was "scammed" by phone apps. Facebook was pre-installed on that particular phone (I forget which one) and I installed LinkedIn (which to this day, tries to trick you into installing if you try to visit the web site).

I noticed that I was getting suggestions on both platforms to connect with people that I had only ever had private emails with, such as real estate agents, insurance brokers - people that you do not want to be "friends" with (not because they are horrible people, but they are just people you were a customer of in the past).

This scared me and I immediately uninstalled the apps - I found that Facebook could not be removed on this old HTC device, so got a new phone. Even to this day, I still get those same suggestions coming up because it is obviously still holding the info somewhere.

LinkedIn is actually useful for me - I got my current job via a contact on there, no interview required. Been happy in the job for many years now... but, it really irks me that when I look at privacy settings, it says it is still integrated with my email inbox - if I delete the integration (in LinkedIn), it says it has been deleted, but if I go back in, it is still there! I have changed my passwords, so I cannot see how it can access anything... but let's just say that I don't really trust any of these organizations!