Looking at Nougat has no more security fixes (3yo), is Google the bottleneck here?

Edit: Previous versions tend to live up to 3 years only. If Google doesn't have initiative to update the service, I guess it has downstream impact to manufacturer to be less motivated to do so.