This is very problematic for Android. It was a question of time before such an issue crept up that left a large amount of legacy devices fully compromisable rem

This is very problematic for Android. It was a question of time before such an issue crept up that left a large amount of legacy devices fully compromisable remotely. This is the biggest problem of relegating software updates to a complex and unwilling group of people, instead of a single party. The biggest problem in solving this issue is: "who is going to solve it?". The software fix should surely be made by Google's Android team, but a software fix is not a solution. It needs to be distributed as well. And you can count on that not going well at all.