I would love to know how many years of support does qualcomm guaranteed for their chipset driver updates. I remember reading this was an issue for Google updating the Galaxy Nexus.
The fact that things move around so much would be indicative of not being really sure how it should look (despite the UI guidelines), perhaps? If I was buying a car and the next version of the car the next year moved the dials to the other side of the dashboard or swapped whether the indicator stalk was on the right or the left of the steering wheel, you'd ask what the heck was going on. Yet this appears to be normal for Android.
I would love to blame my phone manufacturer for not getting updates, apart from Android was started with the Open Handset Alliance. It doesn't appear to be much of an alliance to me.
It's a daft situation. If you bought a laptop and could only install hotfixes and KB releases via Dell, yet Dell did not give them to you, would you be happy with Microsoft? Would you take their advice to just buy a Surface Pro from them? That would be unrealistic because it would ignore the massive market that is Wintel devices; rather you would expect Microsoft to only provide Windows to Dell if they agreed to provide hotfixes Microsoft gave them.
If you had a MacBook Pro and El Capitan would not run on it, yet you were aware of all the security holes in Mavericks and some in Yosemite, would you accept advice to just buy a new MacBook to get security fixes? Or would you expect Apple to backport fixes when they know that a sizeable percentage of customers are connecting to their App Store with older versions, given your purchase fee of the hardware?
The solution to not getting updates for a device is not to buy a new device.
Google boasts how many devices they have all over the world (see last year's io keynote) and how Android is everywhere, yet it failed to mention the important point about Android being everywhere: that it is insecure outdated Android that is everywhere.
Google know how many people are connecting with older versions (the Play dashboard tells you what percentage is running which version), so they should push out updates or mandate in their agreement with phone manufacturers that a timely update cycle should be followed, or the agreement would be terminated. There would be no other way to keep control or maintain a high standard.
I say this with a plethora of Android devices and with my dayjob of writing Android apps. It is a rubbish situation for security.
If so, they have access to a central repository - Google. Google could just refuse to give them the OS with Google apps unless the manufacturer/carrier pushed out updates. It would be in both party's interests to agree to do this - Google because it would stem the tide of insecure phones and the stench of dodgy apps being prevalent even in the official market; and for the phone manufacturer, updates and apps, and happy customers.
At this rate I am not going to get another Sony, that's for sure.
Last straw was the Lollipop update for the Nexus 5, where it turned out a perfectly working device into a nightmare with memory leaks, mobile radio drains and camera freezes, where a daily reboot was actually mandatory. Their bug report tracker is full of complaints, yet they didn't do anything and are casually talking about M. Sorry, I don't have to wait a year, then pray if my current device is going to be supported, or just cave in and get a new device the new Android revision will enter the market with.
So until customer experience becomes a priority, I'm not investing a single cent or a second of my time in Android.
Google is slowly breaking up the OS into applications that it can distribute in the app store which smells a lot like someone trying to get around a contractual obligation using a technicality. There are legal agreements between Google and handset makers that can't simply be dissolved by threatening to revoke access to the app store.