Apps do get updates, but they aren't the issue. The system/kernel/system libraries don't get updates and if they are compromised all your apps are compromised too.
If someone know a vulnerability only in a normal app he can't do anything but look at only this one app, with system access well he can do way more.
(Also Android got some additional security/privacy features after Android 4)