That's not entirely true. They attempted previously to do this via policy (Android Update Alliance), but that failed because it's too expensive for OEMs to update, which is what Treble is attempting to fix. And in the meantime over the past several years Google had taken a policy of backporting security fixes, which many OEMs are on board with and do roll out security fixes.