That article, while generally true, is slightly misleading, in that even if the Android operating system is not getting updates, some Google services, and many apps will be. So browsers for example will continue to get security updates for as long as they're supported. I have a phone running Android 4.4 and it still gets WhatsApp updates.

In practice, Android 5 - Lollipop - is oldest usable version of Android you can use. Many apps will no longer run on 4.4 - for example Firefox since about 6 months ago.

I wouldn't rely on so-called security apps. The design of Android is such that there's little useful they can do. The biggest risk is the The App Store which is full of fake apps or ones that steal data. Sometimes good apps are compromised by malware, or even sold on to malware pushers. That's the one thing that Apple does better - at a cost (to both the user and the developers).