Google has done some serious work of late to be more transparent about its ongoing effort to secure Android.
One practical, visible measure that you can check yourself is the Android security level on any device running Android 6.0 or later. Every month, Google releases a patch that fixes the latest security vulnerabilities. Nexus devices get this immediately, and then it’s up to the other manufacturers to get with the program, approving and releasing the patch for their devices.
To find out the situation on your own smartphone or tablet, go to Settings > System > About device (this may differ slightly based on your particular phone maker and interface).
You’ll see a line that says “Android security patch level.” This will show the specific month and date that Google released the patch, even though you may have received it at a later time. If you see an earlier month you can always check for updates, but in general you’ll just have to wait.