App makers delayed updating to a more secure version of Google’s Android platform just so they could continue to harvest and sell users’ personal data, new research shows.