Meanwhile according to the same stats, Android sits around 37.9%, and I have to wonder just how many of those devices are still impacted by for example the 2015 libstagefright vulnerability. Given Google's guiltless ongoing "throw code over the wall" approach to security and passing the buck on to vendors who almost never ship firmware updates for old handsets, perhaps now is the time for us to begin holding Google to the same standard we applied to Microsoft a decade ago.
Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Microsoft. You've got an even bigger and more complicated mess to clean up, you dug the hole yourself, it's going to take you longer, and you should have started on it years ago
edit: If it weren't clear, the tragedy here is that instead of most devices being governed by a well-tested security process owned by a single responsible vendor, they're at the mercy of a plethora of downstream vendors who do nothing, with the ultimate upstream washing its hands and paying little more than immature lip service to the issue, never mind having anything that even remotely resembles a solid process.