I don't think this is true. Google could have handled Android licensing in such a way that resellers were required to patch security holes within a certain amou

I don't think this is true. Google could have handled Android licensing in such a way that resellers were required to patch security holes within a certain amount of time after release. AOSP is a software license, and governs contributions and replication. The agreements whereby various vendors get rights to sell and distribute Android devices are between Google and the various vendors. If Google had so chosen they could have added conditions to those agreements whereby vendors would be required to apply security updates within some reasonable amount of time. They did not do so in order to increase their marketshare. This decision hurt the platform, at least insofar as security is concerned. It was a choice: marketshare vs. security. Google chose marketshare.