Google now pushes updates to different Android subsystems, just because of the open source nature of the system, manufacturers always keep tweaking the parts that Google can’t update.

The browser engine now comes from Google, as well as various system apps and services. If you buy a Google Play phone (or whatever it’s called these days), Google will update the entire operating system.

Many manufacturers prefer to sell their own layer, and then rely on it for updates. That’s fine in itself, different brands post monthly updates as soon as they come out. That’s okay, but many manufacturers don’t care enough about their users to roll out necessary patches every month.

Cheaper Chinese brands (Oneplus, Oppo, Xiaomi, etc.) sell a lot of mid-range phones and unfortunately often fall behind. The price difference has to come from somewhere.

Fortunately, with Android you have the advantage that the attack surface is relatively well protected from the outside. The integration between the SMS app and the Gallery app, for example, is much higher in the hierarchy compared to iOS, and the same is true for the (various possible) browser engines. This makes it more difficult to directly grab the phone with a single exploit. Then, hashing makes it more difficult for hackers to exploit consistently, because you have to collect binaries for each device to get a good ROP chain. Oddly enough, the main disadvantages of Android also have advantages.