AOSP is not at all like most other open source projects. And even if the bugs would be fixed or backported to upstream AOSP, it's not going to magically be sent

AOSP is not at all like most other open source projects. And even if the bugs would be fixed or backported to upstream AOSP, it's not going to magically be sent as an OTA update to customers. This is a real issue and it's Google's platform, they should take action to not leave customers at peril or force them to buy a new device. Google is the only one who has the power to make sure that the updates get all the way to the customers' devices. This might mean exerting pressure on the device manufacturers and operators who make downstream changes to Android. Otherwise we'll end up with millions of vulnerable devices that could be used (and are currently used) as zombies in botnets.