Google says devices running Android 12 or older that are no longer receiving security updates leave more than 40 per cent of active phones vulnerable to malware and spyware.