Therefore if you must have Android and you are paranoid about security (e.g. you are a journalist), buy Pixel phones from Google since they get the updates immediately i.e. not DELAYED by months (e.g. unlike Samsung which can take months to release security fixes for their flagship phones; Motorola used to be fast to update but that was before they were sold!) but be prepared to buy a new phone (to get one that gets security updates) more often than you would an iPhone or iPad. Typically every 2 years-ish for Google phones rather than every 3 years-ish for iPhones. Which means buying an iPhone ends up being cheaper if you care about not being hacked (which we all should have the luxury of being able to care!).
It makes me sad to recommend iPhones but it's the sad reality; maybe in 2017 or 2018 things will change?
I think Google could square the circle :-) and force Android OEMs like Samsung to update faster and for as long as iPhones but they don't sad face!