Android is open source and has a permissive license. Fundamentally this means Google cannot prevent manufacturers like Samsung from shipping insecure phones receiving infrequent software updates. I am curious as to what you think Google "should" do? Make Android closed source like iOS and ship it as binary blobs and a license forcing manufacturers to ship sw updates exactly when Google says to do so? You think phone manufacturers would agree to that? They would promptly fork off the last open source Android and rarely take Google's subsequent updates.
If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates.
If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates.