There are security vendors that provide services for keeping track of vulnerabilities in your third party dependencies and making sure they're patched. Eventual

There are security vendors that provide services for keeping track of vulnerabilities in your third party dependencies and making sure they're patched. Eventually, device makers will use such services as standard practice, but I'd expect Google to be ahead of the ball here with its own implementation, given what they spend on security engineering. This is not a completely new type of issue but one that has bitten them many times before.