Re: The issue if Google. No one else.
You do realise that it is supposed to be opensource and customisable? So, the manufacturer becomes responsible, and Google can only do so much before they could land up compromising a custom installation, even compromise security.
So, yes, a better way would be optimal. Such as isolating security. Manufacturers use either Google's or others, security code, and the provider of the code provide updates to it. Outside security, the manufacturers customise. It allows common open security initiatives to exist besides android initiatives.