Every vendor waits a month before sending out security patches, including Google. I've never understood this (with Linux desktops as my context) but so if you have a risk profile where the OS needs more frequent updates but still want to use Android, you need to take extra hardening steps such as limiting what you expose the OS to (from the outside (firewall, turn off unnecessary connections like Bluetooth) and inside (potentially malicious apps))