Google is maintaining Android so why would you assume it would cost massive amount of resources for Samsung to port or backport some security fixes now and then? The comparaison with Debian does not make sense.