You need access to the software that runs those SOCs which is owned by Qualcomm. Qualcomm isn't just going to give the sourcecode of those SOCs for Google engineers to tinker around with it. It creates all kinds of crazy legal problems.

It's not just the main Android OS that needs to be patched, the chips have their own proprietary software too.

The problem is that after 3 years, most of those chips have gone EOL and QC wants to put their resources into developing new chips because that's where the revenue comes from (e.g. how they pay their employees). Meanwhile new security flaws keep getting discovered on EOL chips that provide zero new revenue.

So what do you want here? Do you want the break neck pace of innovation to continue which is ultimately very good for everyone? Or should we spend all of our time making sure your Apple IIc still has security patches for 2022? At some point you just have to move on and that's just the trade you make for all technology. You can't simultaneously benefit from this cycle and then bemoan it. If all we ever did was make security patches for your Commodore and AppleIIc you wouldn't have a Pixel3.