But that begs the same question. If you never update your existing phone with google's malware, you should be ok.

Obviously if you buy a new phone that's already infected you're screwed unless you can flash a new ROM on there.

My point is. People's current phones do not have this malware on it yet. If you disable updates and/or degoogle, your device should continue to work as is. Perhaps without being able to use Google Play Store, but honestly that's not huge loss for anyone that cares about this stuff in the first place.