In practice, the situation is not directly comparable to Linux distros; Android vendors produce closed Android forks for each phone, and update these seldom and late. If someone was doing this with Linux distros, they'd be similarly nightmarish, security-wise.