They seem to avoid mentioning the version of Android they are running - the specs only say "Android". I'd like to be exited about this, but this uncertainty combined with the fact that their security personnel is a team of dogs[1] makes it quite hard for me. [1] https://www.essential.com/about
Most team pages I've seen don't specifically identify people working on infosec aspects of the product. That could be an attack vector if you're really being paranoid.