They don't care about security because they have never been affected by having an Android security patch level too old, and they don't know anybody who has. And they probably won't, honestly.

I find it very concerning that I can't download an update to fix this particular vulnerability without a help from the manufacturer of my device. PNG has nothing to do with drivers, after all. And yet, I doubt I'm going to get pwned over this one. Mitigations to the rescue.