The problem is that Google can't force phone vendors to support old devices or carriers not to slack on allowing them. Suppose they did release a patch for 4.3 – how long would it take for the phone vendor to update their custom UI value-subtraction patches, package a release, test it, ship it to the carriers, who will do their own branding and testing, etc?

This only applies to old devices so the manufacturer sees it as pure cost unless many people get exploited so badly that they will never buy a new model again; similarly the phone carriers only consider this a problem if you leave your contract – and given that the most likely reaction is “Android sucks – I'm buying an iPhone” or “Verizon/AT&T/etc. sucks – I'm switching to the other one” they obviously haven't been feeling much pressure to change.

What we need is a legal fix to avoid them punting the costs onto customers: e.g. not shipping security updates within, say, two months requires the carrier has to unlock your phone and release any remaining contract without penalty. Unless it affects revenue, they're going to continue to treat support as a cost-minimization exercise.