In Android, Google's stuck between a rock and a hard place because so much of the distribution is handled by the downstream vendors. Were I google in setting up the distribution agreements, I'd be much more strict on the requirement for getting Google services on the phone, like reasonable minimum security support periods. I'd also make it easier for vendors to be able to agree to such things, by promising support on their end for a reasonable amount of time, and preferably, a stable kernel-level abi so that they don't need to do as extensive regression testing when a kernel-level patch needs released.

Android development feels a lot like current web development plans, where things are released, and not a lot of thought is given to backward compatibility and backporting security. Google needs to tighten those reins a bit, either by pushing handset developers forward faster and/or giving reasonable support for older devices themselves.