Ah the new economical divide.
Most "real people" also have phones which aren't receiving updates for a few years by now.
In south america the median android version is 8.
And phones are not optional as most countries already jumped into both digital government and money transfer.
So it is not really "self created" in my book.
The continuing problem with Android, and a display of Google's lost interest in Android, is that they still stick to this paradigm in 2024. Nowadays phone manufacturers ship stock Android with add-ons, and cellular companies no longer have the power to demand anything. If Apple can ship iOS 18 worldwide next Monday, why can't Google?
Then there are devices, like in China, where Google Mobile Services is not on many phones so Google has no leverage at all re supporting updates.
Which is to say I think you are speaking in terms of what you can do within the android's playground itself, its certainly much more open than ios in that regard. But when it comes to the fact of being able to change the playground itself ie install whatever os you want on the hardware or upgrade the os on the phone then suddenly most phones aren't any better than iphones either. Some are slightly better in that you can at least unlock the bootloader or root it, but I don't know if much progress has been made beyond that in being able to reverse engineer or otherwise them to able to install anything you want on them. That was the point with respect to I was speaking.
There is; it's called the Android Compatibility Commitment. If a phone manufacturer wants the Google Play Store, their phones need specific security requirements. Which includes measures to lock down the phone to prevent piracy of the store, which for most manufacturers is achieved through a locked bootloader.
https://assets.publishing.service.gov.uk/media/61b794d6d3bf7...
Qualcomm is the reason. Qualcomm wants OEMs to buy new chips every year, and for that to happen, consumers have to buy new phones every year. To upgrade Android (across kernel versions), OEMs need Qualcomm to provide updated drivers, which Qualcomm has been reluctant to do, because their sales will be undercut by chips they sold years ago. Android phones are closer to Mac than PCs, as there's one hardware-maker who determines which models become obsolete, and when, based on the software they choose to update (or not).
Does Microsoft just maintain broad kernel backward compatibility, or are driver authors doing more work to support more Windows versions? Is it a fundamental architecture difference with how each OS implements their kernel APIs?
Windows on the other hand maintains a very stable interface and has no desire to maintain vendor drivers.
Last time I checked you could totally use drivers built for windows 7 on a win 10 OS.
“Freedom”, I believe they called it.
Also, hardware standardization in the PC world is pretty much a thing. Not so much in the mobile (and mobile offshoot) world.
Now, if the phone's original OS were open source, it would be easier to make bugfix patches when old vulns are discovered.
Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way.
One big problem with Android is the way driver updates work. It's a nontrivial process to add hardware support for a later Android version because of the Linux roots and having no stable ABI.
I think back to how Windows has changed over the last 2 decades. Once Windows updates were all paid and people would hang on to old versions of Windows forever. Microsoft eventually realized this was a problem for them so paid upgrades aren't what they once were.
Additionally, driver instability used to be a massive problem on Windows. Microsoft to their credit spent a lot of effort improving their driver situation to isolate drivers and have a stable ABI. Windows is way more stable than it was 20 years ago.
Even OSX has adopted user space drivers (DriverKit).
By the way, the above reasons is why some at Google have pushed Fucshia as essentially an Android ecosystem and architecture reset. It's been close to 10 years now. I don't see this going anywhere despite billions being poured into it at this point.
The problem with Windows today is more that it wants to opaquely update itself all the time, and the user gets undesired mandatory "updates" such as ads in menus and sending "telemetry" home (ie user activity data for MS' machine learning ambitions). But of course the most important thing is to keep fucking web browsers up-to-date with laughable and undesired CSS or WASM features (including subsequent exploit/fingerprinting fixes) all the time and even more often than actual content, or what's left of it anyway on the extant web.
As is being pointed out elsewhere, this isn't a vulnerability in an "Android" product. These are TVs running vendor-maintained AOSP builds. They get updates when and how the vendor decides to do it. It's not related to the (fairly reasonable, though often spun) arguments about updates in the phone licensee ecosystem.
It's also something you don't necessarily have knowledge of when you purchase a phone.
It's one reason why people (myself include) prefer Apple. You know you're going to get 4-5+ years of updates.
No? For a licensed Android phone there's a clean split between OEM and OS updates, a clear declaration for support period and a OS-managed tracking of updates with clear visibility to the customer. I get that there are constant platforms flames about whether this is acceptable or inferior to Apple's offering, yada yada yada.
But the point is that none of that is relevant here, because these aren't phones and aren't running a licensed "Android" variant. They're just TVs running vendor-custom firmware that happens to be based on AOSP, and clearly can't be expected to conform to any update regime except whatever the integrator put together.
Basically, the story here is saying "I hacked product A" and you're trying to have an argument like "That's because this unrelated product B is bad". It's a non-sequitur.
Google is now the only option for phone manufacturers. No backup needed. Plan A worked.
After reading your comment, I was trying to find that for India, and landed on this page: https://gs.statcounter.com/android-version-market-share/all/..., and thought that India it is Android 13
But then for South America, the same page (https://gs.statcounter.com/android-version-market-share/all/...) tells should be Android 13 as well
India also has the same setup - digital money transfer happens via phones (in some ways, your phone number is your identity)