I know for a fact most people click every link they receive, or I wouldn't get so much mandatory security training at work, so if millions of people are just walking around after downloading random PDFs and word documents from their email onto their phone, what does this mean?
this is the key distinction. Many people who click on sketchy links all the time also don't update anything unless forced to (understandable but bad security practice lol). Plus even if you do, most phones don't get updates for that long, so if you're rocking a 3 year old phone odds are its not getting them any more unless it's Apple (pixel and samsung are trying to catch up tho)
Software for normals is pretty good at auto-updating these days, even against the will of the user. Plus modern exploit mitigation techniques make actually turning security bugs (which are rarer in operating systems where userspace runs on a VM, like Android) into consistently-working exploits difficult. I'm sure some people get got by e-mail-originating malware using old exploits but I'm not sure how widespread it actually is
I mean sure, true enough but people do hate updating and it only takes one app or component to not auto-update against their will to leave a hole. But yeah, most nasty links these days don't actually install an exploit on your device they just phish for your actual credentials. this trend is probably also influenced by the fact that people with 4 year old phones aren't likely to be high value targets to steal from
I don't think I have ever updated a phone app and thought "wow this is an improvement I sure am glad I updated"
exactly! I'm not saying people are wrong not to update, but if given the option many won't because of mostly valid reasons like that. free/open source apps tend to be better in this regard, generally security fixes will be backported to old versions for the lifetime of the OS, rather than forcing everyone to update to the latest version to get the security fixes. More recent developments like rolling release distros and flatpak, snap, etc. are moving away from this though... (for both good and bad reasons). But at least if it's open source there will always be the option of backporting the security fix, proprietary apps don't even give you (or the community at large) the option