It's not a CRA obligation, but a rule from ecodesign requirements for smartphones (Reg. 2023/1670)

> security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;

https://eur-lex.europa.eu/eli/reg/2023/1670/oj/eng#anx_II

So by delaying AOSP releases by 4 months, Google is allowing OEMs to leave their users exposed to known vulnerabilities for up to 8 months.