My last attempt at an android was a Samsung Note3 on Verizon.
Pretty much every app had 3 versions - google/android version - samsung version - verizon version
Locked bootloader so couldnt' really remove the duplicates.
Critical Security update released by a google? Well first has to be approved by Samsung ... that takes a month at least , then approved by Verizon.
Realistically if you saw the security update w/in 3 months that was pretty fast.
So a zero day exploit ... 3 months waiting for patch.
Android really won.