This is basically why I treat my phone as an untrusted device. The rest of the world wants me to use my phone as an extension of myself, but I treat it only as a portal to the public world. Security updates are almost irrelevant if there is nothing too sensitive on the phone. In particular, I don't have my gmail account on my phone, and I don't have access to monetary information on my phone.