That's just not how businesses work. Companies that sell Android phones want to have control over their platform, and above everything "differentiate" themselves from other android-selling companies.
Also note that each company has different hardware, custom drivers, etc. ; those are often not compatible with new updates and they need to do additional work to make things work correctly, work which they might just refuse to do.
No hardware company is going to refuse to update Android "just because". With this modular base, they have no reason to not update.
This made me realize just how weird the phone business is. Because it's not how "businesses" work at all! It's just how smart phone manufacturers currently work.
Imagine if Microsoft couldn't publish security updates without going through Dell, HP, AND your ISP, and you start to realize how crazy the situation currently is.
The actual weird thing is the PC market, which is pretty much the only place where a third-party software manufacturer is not treated as a subordinate supplier by the hardware manufacturer of the device the software runs on.
And it's mostly a side effect of the missteps that IBM made in the 1980s because they didn't understand the market dynamics, which is why they aren't in that market, commodity manufacturers are, and Microsoft was the big winner, not any of the hardware players.
Well, Google could have just pulled an Apple and don't licence Android for manufacturers that allowed this. Can't tout "bigger install base than Apple" with that, though.
With this modular base, they have no reason to not update.
They do. It is not only a technical problem. If it was, they would be happy to roll out security updates for existing Android versions (without rebasing to later releases).
A large part of it planned obsolescence. Device makers and carriers want users to buy a new device every two years, to make money and tie them to a contract longer. A newer OS version plus security updates is a big selling point. Secondly, vendors and carriers just don't want to put in the development time and testing. Since most users will buy the hardware anyway, why waste money?
The only real solution to this problem is that Google would require minimum support terms in order to license Google Play Services. Or a change in consumer mindset.
Also note that each company has different hardware, custom drivers, etc. ; those are often not compatible with new updates and they need to do additional work to make things work correctly, work which they might just refuse to do.
No hardware company is going to refuse to update Android "just because". With this modular base, they have no reason to not update.