But doing timely security updates is not impossible. Apple does it, GrapheneOS does it, Google does it with Pixel, Samsung is nearly doing it on flagships.

But many Android OEMs are probably terrible at software engineering and have their attention spread across multiple SoCs, etc. It’s their own fault.

Then they should leave it to others. Release specs and sources and let whoever wants, maintain the firmwares.