Does it receive real security updates (i.e. all the CVEs that are supposed to be fixed by that patch level are actually fixed), or "whatever we can reasonably fix" updates where e.g. the kernel is left on an outdated version without fixes because the fixes never got backported and upgrading the kernel is impossible due to limited support from e.g. the SoC vendor?

https://www.wired.com/story/android-phones-hide-missed-secur...