[jwatt]

I agree the number of attack vectors is significantly reduced in comparison to the same version of Android on a smartphone (particularly if the user is making little or no use of the music player's already limited app store). But there are still many, many CVEs for Bluetooth, for example. Taking the Bluetooth example, I would be happier connecting to a hire car's audio system with a version of Android that is getting patched than a version that is not, and may have known vulnerabilities. I don't want my DAP to potentially be a vector for transferring malware around.