Welcome to Vodafone Community
I have a Moto G Play phone with a monthly contract.
I've noticed that the Android version is 6.0.1 and the Android secuirty patch level is 1st Feb 2017 which is over 1 year old. Is there a problem with my phone or has Vodafone not released an update?
Security Patches typically come bundled with a firmware update @muross
Have you looked in your phone's software update section to see if one is pending ?
Some phone's can also come to their end of firmware update cycle and stays on what its currently on.
Current Phone >
Samsung Galaxy s²² Ultra 256gb.
Secondary Phone >
Samsung Z Fold³ 256gb.
Any security patches to Android have to be sent from Google to the manufacturer (in this case Motorola) so they can tailor it to their specific handsets/OS. Once the manufacturer is done with it it is pushed to networks (in this case Vodafone) for testing and eventual push to customers.
Each of these stages can take a number of months. The manufacturer and/or network could also choose not to push out the updates and instead bundle a bunch of monthly ones into a major OS update (again this takes a long time to get to customers, the Samsung S8 for example is only just getting the newest version of Android released in August), or simply stop sending them out.
For this very reason I decided to buy an unbranded Pixel 2 which gets security patches direct from Google within a few days of release each month. The security risk of all that personal data having patches sometimes 12 months old was too great for me.
On top of that, some manufacturers never do issue interim security patches so you're stuck until the next platform update (if the device gets one).