Android device's lifecycle is worse then iPhones: I replaced my (almost 2 years old) HTC Desire because it was stuck running Android 2.3.4 - thanks to Cyanogenmod, otherwise it would have an even older OS - which means security vulnerabilities like the recently found USSD "remote wipe by visiting a website" are exploitable.
