OTA updates DIRECT from Google to Branded phones
I see the big problem here being the delay between Google making a patch and Manufacturers/Operators incorporating that into their patch. If the Google could just patch straight away and al devices were updated at the same speed as Nexus devices then this would go a long way to helping mitigate the problem. As it is, manufacturer patches are MONTHS behind urgent Google patches.
Now, I don't know how hard this is to do (even though I am currently learning Android and have written a couple of basic apps - doh!) but it simply has to be done. The firmware has to be compartmentalised such that a pure Google path can be done on every phone (and is done in cases like this).
This kind of security flaw really erodes faith and trust in the platform and we cannot go on like this.