I think you fundamentally misunderstand Android if you're comparing how Windows does updates to how they are done for Android phones.
The base of Android (AOSP) is an open source project (yes, open-sourced by Google, but still exists independently). Anyone can take AOSP of whatever version they like and produce whatever they like with it - Google have no control over this. Google have built proprietary value-added services on top of AOSP (play services, maps etc). These services are optional, and Google alone is responsible for updating them in a timely manner (which it does, frequently).
What we're talking about here is updates to the AOSP base. Google collates the updates and releases them to vendors/partners every month, 1 month before the public release. Hence any company with sufficient interest in updating their customers can get access to these patches a month before the public release. I'd be a little surprised if the Google internal teams don't have access to the patches earlier, so perhaps they get a head-start, but if a company was sufficiently determined, they should be able to get the patches integrated, QA tested and released within that month.
However, operators sit as another layer between the vendor and customer - they typically do some "value add" tweaking and then they have to QA and release. And it may be that phone manufacturers wait for kernel updates to come from the chip vendors such as Qualcomm, who have to do their own testing. Getting all that done within 1 month probably isn't realistic.
I'm not saying Google are entirely blameless here, but the main responsibility has to lie with the handset manufacturers, since that is who has released the product. They cannot wash their hands of it after release - they should be pushing all the chain to QA test and release security patches in a timely manner. It is a question of priorities - and the simple truth (as the OP was trying to indicate) is that whilst Google prioritises getting these patches out every month for the phones they have direct control over, other manufacturers don't seem to show the same level of enthusiasm.