This reminds me of the OpenAI hack against Hugging Face.

Regulators present an impossible goal to the companies to implement, instead of implementing the goal, the companies try to reward hack their way around it.

The end result is that they basically try to make it impossible to know about vulnerabilities because that would start the clock.

But doing timely security updates is not impossible. Apple does it, GrapheneOS does it, Google does it with Pixel, Samsung is nearly doing it on flagships.

But many Android OEMs are probably terrible at software engineering and have their attention spread across multiple SoCs, etc. It’s their own fault.