Enforced how, on who, by whom? Google can say "They're fixed already, just upgrade to Android 5.0.1". Manufacturers and Carriers can say "Meh, we're still testing it". Enforcing such a rule requires holding a particular party responsible, and that party must have some authority to hold other involved parties responsible for doing their parts.

Probably the best thing that could be done overall is Google's already-complete plan to move the web browser, and as much other code as they can, to Play store apps that they can centrally auto-update. But getting that solution onto the vulnerable phones required them to, once again, just upgrade to the newest Android.