[X Style (Pure) General] Jason.DROID:
Honestly, it's very easy for Google do to monthly security updates, and it's good that they're being proactive about them after being dragged through the mud by Apple bandwagon sites and general media (along with those dubious "security research" firms) after Stagefright. They have nearly unlimited resources and get an astounding amount of advertising revenue from Android itself. But, it also helps that they created and maintain Android itself.

I do think they hurt smaller manufacturers by putting this expectation of monthly security updates in people's heads. Android manufacturers, with the exception of Samsung, usually are not flush with cash. Just recently, LG's mobile division lost over $100 million in 1 quarter alone. Unless you have a loyal fan base that looks forward to new devices year after year, like Apple and (again) Samsung, it's a difficult position to be in. I do think it's furthering Google's own agenda, however. They are very slowly herding people into the Nexus program and into the pure, ideal Google Android ecosystem. There's already a gulf in feature sets between pure AOSP and Google's AOSP-based Nexus apps; pure AOSP is looking extremely barebones these days as Google has basically abandoned the basic apps in Android (like the dialer/Phone app, for example - it got a visual overhaul, but no new features except on Nexus devices). I only have the Google dialer features on my MXPE because Google accidentally released a working version for non-Nexus devices. It's certainly not great for AOSP-based phones like the MXPE.

Eventually, though I think Google will keep Android open for the foreseeable future, I do believe they're working on a new Google-only mobile OS where they control both hardware and software elements (chip design to custom tailored, proprietary kernels and hardware drivers). I think Android served its purpose for Google: to become a dominant OS, a viable source of advertising revenue for the company, and a viable ecosystem and market for digital goods (Play Store). Those Google services and Play Store ecosystem can be implemented into any OS they create, just as it was recently made available to ChromeOS devices.

Anyway, at the end of the day, you have to ask yourself if any of the Android devices in your recent past were terrible or completely insecure. Because, I've seen people change opinions on good devices based solely on security updates, even though the devices in our pretty recent past didn't receive them. So, if you're afraid Android is insecure even though you've never experienced an attack, even with those older, "less secure" devices or now on a newer device without monthly security updates, why continue to use Android? Apple is still continuing its strategy of implementing security updates in OS updates, by the way. Those are not monthly.

Malware is still required to exploit many of these vulnerabilities, and I'd say the great majority do need root privileges to be most effective, which is why those elevation of privilege vulnerabilities need to be patched. Will security updates protect you from sketchy online behavior or being gullible (phishing emails, popups claiming you have a virus, etc)? Nope.

I'm fine with quarterly updates - 4 quarters, 4 "rollup" updates.