It's not Google's fault that Samsung isn't releasing an update. Google is certainly not blameless for the security problems Android has, but it's a very nuanced problem that goes beyond simply blaming a single party for the state of security on the platform. Samsung is far more to blame in this case for tons of reasons.
I could go on and on about this topic as it's a huge part of my job... but I'll spare you unless you're actually interested.
No it absolutely is Google's fault. They have control and could have and should have mandated update guidelines. Likewise, yes, the carriers fuck things up but again that is Google's fault for letting them do that.
And no Samsung isn't blameless, but Google absolutely could have made this a non-issue years ago but decided they'd rather make Android a total clusterfuck instead.
Plus they've constantly harangued Microsoft over security and yet Android is a total fucking joke in that regard. And we're getting the same bullshit we've gotten with Android updates in general (funny how every other year they say how they've resolved performance and made it smooth?), so anyone expecting there will be anything meaningful actually done to fix this stuff longterm is just delusional at this point. But we'll get a lot of talk about how they totally fixed it with this next major release, just make sure you buy the latest phones so you can enjoy those perks! Until the next update fucks it up again. I'm not an Apple fanboy either, but if it wasn't for them we very probably would not be getting the quality fingerprint sensors (that still took Android what 2 years to get to that level?).
Security should have been a major integral focus in Android development. Google is responsible for the state it is in. Yet we get "no its Samsung's fault!" "no, no it is Verizon/AT&T's!". They're all culpable, but Google needs to take charge and resolve this.
What is also dumb is Microsoft is getting trashed for not playing ball to appease the carriers which would end up putting them in the same position as Google, compromising end user control and security.
Damn! Was really hoping the Note 3 would get it.
This is bullshit.
I know, especially after I believe Google came out and said they were pushing for devices 3 years old to get the latest version. And several of the OEMs said they were working to make that happen. The Note 3 is barely 2 years old.