That's of course a minimum requirement. But the analysis showed that it took e.g. Samsung 8 months from distributing vulnerable code to distributing the fix for one the CVEs. Google was faster, but even them it took several months.
> Android is an immutable system,
OK, system might not be a uniquely defined term here. As always it depends where you draw your system border. If you mean the system firmware image, it is probably immutable. Not sure whether all vendors use dmverity.
However, I meant "the whole phone". Obviously Android phones are not immutable, you can install apps. And after rebooting they are still there and can again use the same vulnerability if there is one. What I meant by immutable is there is no way to install any executable code, because all storage that is writable is noexec. And even if a vulnerability exists and allows to mess with RAM, the corruption is gone at reboot (well, unless the write protection, code signing / dmverity itself is affected by the vulnerability). Without having really worked with most of them I understand Vanilla OS, Fedora CoreOS, Fedora Silverblue, and SUSE ALP all go into that direction (although they still allow installing additional containerized apps).
Including a browser and an email client into the base image and removing the option to install anything else is what I meant with immutable Linux distro.
When you update it, you install another signed image. Of course the supply chain for that image is then the risky part, you'll never have zero risk.