One of the issues with Android security over the years has been the way that patches are delivered to users. Google distributes updates directly to the Nexus and Pixel devices it sells, but carriers and other manufacturers are responsible for getting updates to their own customers. Some handset makers, including LG and Samsung, follow Google’s lead and send monthly updates to some of their devices on the day they’re released. But many others either deliver them much later or not at all.
In its annual report on Android security, Google said that while the monthly update schedule has helped, it hasn’t fixed the problem entirely.