That is definitely true. Once the vendor stops putting up those patches, it does become quite problematic. So as long as you keep your Android up to date as best as you can and primarily use open source software and ad blockers, you should be alright in most cases.