Controlled? No. It's about security updates being patched before disclosure.

That said. it is indeed annoying, and there was a lot of uproar when it happened.

For the nuance of it, I'd suggest GrapheneOS docs, you'll get more accurate info.

https://discuss.grapheneos.org/d/27068-grapheneos-security-p...