The best solution is obviously sanctioned rooting so that vulnerabilities can be freely shared with manufacturers and fixed.

But that's not going to happen.