You could argue Google have already fixed the bugs - in Android 4.4 and newer - and that it's the carrier and manufacturer's responsibility to issue those updates. In many cases even if Google issues a patch, carriers and manufacturers don't bother to issue an update for their own devices. So is Google really entirely to blame here?