Android 16 public tags don't match security patch level

At what point does incompetence start to look like malicious intent?