They're skirting the law and they're likely to be breaking it too - if not on cybersecurity grounds then almost certainly on anti-competitive grounds.

Even if we set legality of their behavior aside, they deserve scorn for how they've been managing Android for the past couple of years - every Android user is worse off because of them. They broke off productive relationships with grapheneos and other projects which contributed patches and reported vulnerabilities upstream, they're engaging in anti-competitive conduct and imposing limits on OEMs, giving Pixel devices preferential access to new APIs.

They're simultaneously putting their own customers (Pixel owners) at risk of known, exploitable security vulnerabilities. They do this to help other OEMs legally skirt (maybe) the 4 month timeframe for patches which is very lax to begin with. Thereby opening a whopping 8 month window where Android users can get hacked by known vulnerabilities.

Their Android 17 QPR1 release was so buggy, it made many Pixel devices almost unusable and then they went radio silent. https://grapheneos.social/@GrapheneOS/117372129125340408

How cynical do you have to be to defend their stewardship of AOSP?

> Google is not being spiteful here like some commenters are saying; instead, they have changed the way they work to make it compatible with a new law that applies to them

Read the second link I posted above, this is patently false.