@Earth: I have to disagree with some points.
About vulnerabilities, you may be surprised, but
iOS is actually more vulnerable, let's say about Windows and Mac OS, Windows is more popular than Mac OS of course, so it is attacked more, but did we ever expect to see Mac having all those vulnerabilities? That's the case about Android and iOS.
About Malware I agree. Most people install apk's without knowing it is safe or not. But Google is verifying apps in the Play Store, and they also started verifying sideloaded apps (installed from outside the play store), even for the devices running old android versions (I tried it on the 2 year old Gingerbread). But who can find all the malware targeting a specific operating system?
It's better to put the third and fourth into one. The cause of the delay of the updates is due to the manufacturers adding more bloatware, which in turn makes the device slower. You can get a Nexus device (better not carrier locked), which gets really quick updates and are also supported for a long duration. The Nexus S is an example, it was supported for almost 2 years, despite it running on ancient hardware, and its performance is
good.
Or a Custom ROM can be another solution. They offer a much better experience than the manufacturer's ROMs, and even make the phone taste the desserts it didn't have a chance to taste.

I am currently a happy CyanogenMod user running Jelly Bean 4.1 on a Galaxy S1 Plus, which was officially supported until 2.3 Gingerbread.
I never found a reason to install an antivirus on Android. Common sense is still doing an excellent job protecting from malware.