Moreover, Samsung is already experimenting with Tizen (they actually released a Tizen-based smartphone in India) and companies like Xiaomi and open-source projects as CyanogenMod (used e.g. by OnePlus) demonstrate that Android alternatives exist and are viable. It's as I said, Google has effective control over Android, but Android itself can be replaced if so desired. Moreover, if people get fed up with the lacking (security) updates on Android and are looking for alternatives, manufacturers could switch to Windows 10 Mobile too. The entire situation is so delicately balanced that no party would dare upsetting it. Ultimately, Google doesn't even have to care. Google's mission was to bring their own system to the masses, coupled with their own Google apps. Google obtains its revenue not from Android proper, but from the services it delivers (data collection + advertising). Google doesn't inherently care about these security issues, especially when it can easily put the blame to OEMs which are not upgrading.