If that truly is an issue then Android is a fundamentally broken OS.

How many different models of PCs get released? How hard is it to patch any of their OSs?

If you can't support 50 different models, then perhaps you shouldn't be releasing 50 different models.

That's still one OS. Customization is mostly userspace "system" apps that they swap out and maintain, but reused across all their phones with some small variation. Hardware enablement will differ between models, but that's just the cost of doing business.

Can be a pain to move the whole suite to a new major (porting all their inhouse apps, getting all the hardware enablement from vendors updated to match, ...), but we're not dealing with a major upgrade here.

A security patch is "just" a matter of taking the last release, applying the diff, build, qa, release. No customization.

Weird how LineageOS supports ~300 devices while still managing to release patches.

I bet this CVE's patched quicker on a samsung device running LineageOS than the stock OS.

The real difference is that Google has a more competent software development process and release process than other android OEMs, regardless of how many different devices they have.

If they choose to release 50 models, they need to factor in the cost to maintain security on 50 models.

The fix was released in September according to GrapheneOS, so you'd think they could have it out for the flagships

They must release drivers and firmware for all the devices that they no longer support.

And 5000+ laptop models per year, yet linux runs on (pretty much) all of them. This is an entirely self-inflicted problem. They don't deserve an ounce of mercy.