It is not a problem that is retroactively fixable by other means than by what they are doing now.
They could take Android closed source and put a restrictive license on it demanding that timely updates as a condition of use. All that would achieve is that the large vendors will either stick with the old, still free to use, Android or start working on their own systems they would control again - Samsung's Tizen, Huawei is developing their own, etc. It doesn't take much to piss a large vendor like Samsung off sufficiently to jump ship. They aren't married to Android and have plenty of resources to pour into proprietary alternatives. Google doesn't have much leverage there.
The result would be only a market fragmentation, collapse of the app market and loss of market share for Google. That would benefit exactly nobody.
Phone vendors are not interested in system updates - that's a pure cost they don't want to pay, they would rather have you buy a new phone or at least not have to spend money and engineering time on preparing patches.
Google could for instance not allow the manufacturer to connect to their Google Play store unless the manufacturer played ball.
But where does this all put us? We are OK with crap, insecure devices being shoved all over the markets? What can be done.
Very true but I think the point GP was trying to make was that Samsung is bigger bthan Apple and would have enough influence to get a lot developers to work on its platform instead.
"Must keep firmware updated with security fixes."
Only because Google lets the device manufacturers off the hook. It's a problem of Googles own invention. Trading away customer security for market share.
Adding: very successfully too, this isn't the first time I hear how you should almost feel sorry for Google that they have to put so much into google services instead of Android, all because of the evil device manufacturers! Nothing can be done no... wrings hands
Maybe it will change a little but now that Huawei happened.