I'd argue that the decision to keep it in userspace was the right one. If an application doesn't get security updates, a broken QUIC stack is probably the least of your worries.
You also mention Android, which is notorious for having a lot of devices that don't get OS updates because they've reached end-of-life.
Protocol ossification at the OS level is also a valid concern.