I&#x27;m not sure why the writer mentions this. (It&#x27;s probably an excuse to link to another Vice article.) The Android version number in itself isn&#x27;t a good indication of the phone&#x27;s vulnerability. Stagefright, for instance, was patched for 4.4 in many phones without an upgrade to the API.<p>An Android phone&#x27;s security depends on whoever is responsible for maintaining the device&#x27;s ROM, usually the carrier or phone manufacturer. Samsung, for instance, includes extensions intended to enhance security. Admittedly, for $10 I wouldn&#x27;t expect much in the way of OTA updates. But except for a few changes to the framework in the way app permissions are handled, the version number isn&#x27;t the best measure of security.