Anything in the Linux Kernel
PCs are the proof that manufacturers don’t have to push security updates for decades. But in the phone world, they would have to because they don’t want to open the platform. So the user is dependent on the manufacturer for updates. But it don’t have to be like that.