Earlier quoted context omitted.
But 2.3 (Gingerbread) was released in December 2010, so his device indeed runs something released in the last six years. In an ideal world (for software and hardware vendors, at least) we would be replacing devices with their latest versions as soon as they come out and backward compatibility wouldn't be a problem. However, I can imagine a situation where spending $100 on a new phone is a luxury and not everyone can…
You're right about the release date. Not sure why I thought 2008. Like XP, Gingerbread has unpatched security vulnerabilities. Having a mobile phone with up-to-date security is well worth spending $99 (for a Moto G, for example). I get that not everyone can afford something like that, but it's like car insurance. You absolutely can't afford to have your identity stolen.
I agree that having your identity stolen is something you cannot afford. But then again we are both frequenting Hacker News so we are aware of how technology works and how damaging compromised security can be. An average user however might not realize that an outdated Android version has unpatched vulnerabilities. They are just happy that they can send Snapchat messages to their friends and can watch Youtube videos when they are waiting for a bus.
Also, how long before Moto G stops being supported with updates and becomes vulnerable as well? What should happen next?