Android v1.5 and 1.6 (eDGe) contains numerous vulnerability. Google it http://www.google.ru/search?q=androi...client=firefox Only latest version of android has not known exploits.

Also, do not confuse OS vulnerabilities with security holes in the applications and mallware. Usually vulnerabilities used to get root access to device, but there's absolutly no needs for root to use malware, steal you private data or send spam using your hardware. As far as I understand, the main problem why developers don't want to give us a root, is that they use one root pass for all device (which is usuall for corporations, but it's BIGGEST security hole, 'cos if hackers find out root pass, they will be able to get remote access to every eDGe).