In Germany there are quite a few stores still selling budget Android 4.4 and 5.1 devices, which people keep on buying.
But no one want to get computer with Windows 95 (or 98) anymore. Just Android 4.4 is "OK".
Security vulnerabilities? Nobody was ever affected by those (at least in the social circles of the people buying the devices), so why should they care?
They should do a yearly release (eg. Android 2018). Then at the store when they display phones, they'd have to write "Android 2013" instead of "Android 4.4 KitKat."
This is why software/hardware needs best before dates.
The only viable alternative was Windows Phone, but that is gone now.
Microsoft are the only ones who ever managed to make the separation between OS vendor and hardware vendors work (at least on the PC side). They are sorely missed in the mobile space.