Every platform is going to have security vulnerabilities. What's sad about Android is how many phones are running ancient versions. All of this customization crap slows down the rollout of security patches. Yes, yet another reason why the Android ecosystem needs to crack down on customization.
And this new agreement among the carriers has truck-sized loopholes. The best one is "if the phone supports the update." What's to stop the manufacturer from saying it doesn't?
But you're right, the manufacturers are hurting their customers with unsecure old versions. Ugh.
As to Exchange integration, I'm amazed it works at all. Android naturally works really well with Gmail because that's how everybody at Google uses it. Once you get away from that...
The thing that kills me is that on my Nexus One, no joke, it works
perfectly. Every contact synced with every piece of information. All 7000+ names in about 90 minutes. It's the sh***y HTC junk that acted all weird and wouldn't properly display or sync all the contacts it should have. It's extremely frustrating, and I spent two hours on the phone with HTC about it. It's aggravating that they can't give out any message other than "there must be something wrong on your end." Clearly, given that I've done every bit of troubleshooting possible and every piece of information points to the Sense app as the problem, it's HTC's fault. I don't know what I was hoping for. Maybe they'd give me a magic button sequence I could enter in the dialer that would unlock the plain Android OS on the phone