Most security issues are handled by security updates, which don't require a letter update. They're issued as patches, so OEMs can issue them for an older device without updating it to a new release. https://www.android.com/security-center/monthly-security-upd...