Just to set this question up, I have an HTC One m8 (AT&T) that is on Android security patch level 2016-03-01 with a software number of 6.20.502.5. The phone is in excellent shape because I take very good care of it. My question has to do with the fact that security updates only come for a certain amount of time on Android and the situation is worse when you use a carrier locked phone. How important is it to have the latest security patch levels? Should we really worry enough to justify buying a new phone every 2-3 years? I honestly don't care as much about having the latest Android version even though it's fun to play with things after updates, but it seems to me to be reckless to leave your customers open for trouble.