If Google are so great ...
... how come they abused their monopoly by forcing vendors to use Google Search and other services, but didn't use the same power to force them to issue security updates for the OS?
Good question. I do wish that Google would make timely support with software updates a requirement for any vendor licensing Android.
I can see why they might not, though ... part of the answer to that must be that most vendors will bow -- albeit perhaps grudgingly -- to Google's bundling requirements because complying with those doesn't actually cost them very much money. They're barred from producing some other products for which there might be a market, but that market isn't very lucrative.
Having to keep an OS version in development for an old device has an ongoing cash cost that the vendors are unlikely to swallow with good grace. Google keeps the vendors on-side by refraining from making that a requirement.