Yep. Exactly how Windows and Linux work, just with a much shorter cycle time. Try to get an official patch for Windows 98 or Redhat 6 and see how far you get.
It would be nice if the Android support phase were lengthened.. 12 or 18 isn't really long enough when the average phone replacement cycle is two years, and a quick Googling suggests that its even longer in other parts of the world. That means there's a hell of a lot of vulnerable devices in the world.
And I realize that Google doesn't have much say over what HTC/Samsung/whoever do. But there's things they could do to promote a better global atmosphere:
- Add a licensing requirement that derivatives must always be capable of being imaged back to the base OS install (well on a rooted phone at least.. this wouldn't be the place to restrict software lock-ins even if Google wanted to.) Losing the functionality of non-core features would be allowed as long as the base system runs (ie: if HTC adds a blood sugar monitor for example that isn't supported in the core OS, then it would be fine for that to just not work when the core OS image is installed -- as long as it doesn't prevent the core features from working.)
- Develop an extremely strict driver structure that can, with a high degree, guarantee that old devices will continue to work with new OS versions. Similar to how modern versions of Windows and Linux can still be made to run on absolutely ancient hardware (albeit slowly.)
The first point means a user could always (with rooting) revert to the core OS, and the second point means that they could always update that core OS to the latest version. They may lose functionality and it may run like a snail but they COULD do it whereas right now its a shot in the dark at best and an insta-brick at worst.
But it will likely take the kind of customer pushback that MS faced after XP to push Google into a more structured distribution model. And that in turn will likely require a high-profile, user-visible virus to come as a wake up call to the masses. Viruses that just take up a couple of cpu cycles but otherwise remain invisible tend to not be noticed by anyone outside of the tech community.
In the meantime, Cyanogenmod is the only real savior for older devices.