So security updates are open source? Not like security preview releases that are under embargo?

Well that makes it less problematic. Android apps are independent from the core OS and half of the people is running old versions, so the ecosystem doesnt really depend on the latest and greatest.

Still shit, but less bad.