I doubt most users are aware of the lack of updates. Or security. There is smartphone malware out there, but there's not been any big outbreaks that hit the news yet. Personally I suspect that's only a matter of time, and I'm amazed Google have got away with being half-arsed about security for so long - though obviously controlling the app store helps a lot.
In fact a lot of users don't even want feature updates. Once they've learnt how to operate it, they get grumpy when the software and UI changes.
I think being network unlocked is much more important. As well as price, obviously. But then the two are related. You don't have to sign up to long contracts, you can switch to a cheaper deal and not have to pay £20 to unlock the thing. Which is also really good even if you like to upgrade every year, as many people won't take a second-hand phone off your hands if it's locked to a different network to them.