A robust OS doesn't need security updates unless new security exploits/vulnerabilities are discovered. Unfortunately, even the best of the best smartphones always has inferior computational power than a solid desktop computer - and they're always sharing data with networks by their very design - so unfortunately new exploits/vulnerabilities to attack smartphones can be discovered and distributed faster than they can be patched.
I'm selective about updates and I utterly hate having them forced onto my machinery without my consent (let alone without my knowledge). I disable, block, control, and audit them as much as possible. Things which worked fine yesterday can suddenly change tomorrow. Things which worked fine yesterday can suddenly be broken tomorrow. Why "fix" something which ain't broke?
Google is infamous for forcing such undesirable updates on users. The only companies which are even worse are Apple and Microsoft. Samsung is far from innocent - and they've made a few blunders, like everyone else - but in the past their updates have generally been far less noxious than what their peers have released.
