When I said "upgrades" I was talking about the users who purchased a device originally running iOS 6.x or earlier, and UPGRADED it to iOS 7. I wasn't trying to suggest that 90% of the iPhones out there had been purchased in the past few months, that would be quite ridiculous!
If there are 600 million iOS devices in use, and 75% are running iOS 7.x, that's 450 million devices running iOS 7. If Apple has sold in the ballpark of 35 million iPhones since iOS 7 came out (therefore sold already running iOS 7) plus 10 or 20 million iPads, that means the remaining roughly 400 million devices running iOS 7 were UPGRADED to iOS 7.
How many devices running Android never get an upgrade offered to them, or only get one? Yes, I know you can root and upgrade, but only a tiny fraction of Android owners do that. That's the difference between iOS and Android. Whether it matters all that much is another matter, you get some new features with upgrades, others that depend on hardware you can't get (i.e no fingerprint scanner on an iOS 7 upgrade, just as you don't get BLE on an upgrade to Android 4.3 unless the device has the hardware) For security issues, it can be a big deal however.
You talk about the much larger number of Android devices out there, but that makes the problem worse for Android, because not only are there fewer iOS devices in the first place, there are MANY fewer running an outdated version of the OS. That leaves a big opening when security issues are found in older versions of Android, because the owners of those devices are for the most part entirely screwed, because once the phone is sold the vendor no longer cares about you so you aren't getting upgrades 4 years later as Apple was doing for 3gs owners.