The other problem with Android is, once patches are pushed out it's up to the device manufacturers and cell carriers to push out the patches - even the monthly security fixes Google makes!
I only just now got January's security patch "level" with the Android 7.0 update a couple weeks ago with nothing newer available (the latest security patches before the upgrade came from June 2016!).
It's terrible to see not too old devices stuck on older Android releases with old security patches with little chance of updates unless you're willing to install custom ROMs on your phone. Either that or buy a Pixel which gets updates quickly. Whereas Apple devices can update to newer iOS releases almost immediately after release, even two year old devices!