Are old Android OS's a risk to Activesync email, and how do I block old devices?

I'm concerned that old versions of Android may be hacked, exposing Activesync email data. To mitigate this, I'm considering blocking old devices from accessing the server.

• 
  

  Is this a legitimate concern?

  
  


• 
  

  How would I block these devices?

  
  

This concern stems from this Forbes article saying Google will not be deploying patches to old phones, and will rely on 3rd parties instead. Given that Android malware has been increasing in frequency, this may become an urgent situation