As I remember it, most of these critical bugs are in the Android browser, which is considered a core part of the OS in those versions. The trouble with that is there's no way to update it without doing all the work of a whole OS update, including the usual mess of getting approval and merging changes from device manufacturers and local carriers.
It seems more understandable that way that Google told them to just upgrade to a newer Android version instead.
It seems more understandable that way that Google told them to just upgrade to a newer Android version instead.