I thought that too with my last Android. It never got them, so my next phone was a 6S Plus in 2018 (launched in 2015) that still gets updates.

How do you know you didn't get them? They are silent. Also, I don't think that 'not getting them' is an option other then with video drivers. The whole idea is that security updates should be pushed immediately to all devices and not require user action. You get them even if you don't want them.

There was a place to check in settings. The last one was years before. I don't know how it's done now.

No, that's just for the security updates that must be applied as full firmware updates, usually because they are in the kernel. Google has been progressively redesigning Android over the past decade to the point where they can do all non-kernel security updates immediately and silently via the play store. It's a much better way to do it IMO.

So to be clear: I have no clue about any of this. I like not having to think about what's going on under the hood. I've never had to since getting an iPhone.

It sounds like what you're saying is Google has only continued to shuffle ever more vital functionality into the Play store since I left Android, which negates the often claimed benefits of an "open source" operating system. If all the important stuff is in a proprietary blob attached to a proprietary platform, I might as well stick with the one I already know that's never given me any trouble. I'm not going to root my iPhone or install a custom OS, so that's irrelevant to me.

But you don't have to worry about or understand the Android security updates - they are applied without you even having to do a firmware update. As you indicate, security updates are not something you should have to worry about.

And just because they are applied by the play store doesn't mean they are closed source. The play store itself is closed source, but the security updates to the OS get published via the normal processes.

Android is open enough to allow competition, eg. Amazon's Android, Microsoft's Android runtime, etc. are all done without Google's permission.

To me, that's key, but I'm not trying to tell you whether open source should matter to you. I just wanted to clear up the stuff about the security updates because I think the Android way of doing it is now better than Apple's method.

I have to manually search for the Google Play System updates on my Galaxy S21 and Z Flip 3 (both quite new phones) because they are not being installed automatically. My brother has the same problem with his Galaxy S21.

Somewhat? The browser and presumably the webview is distributed through Google Play, yes. But kernel upgrades are not.

Almost all attack services are now updated remotely by Google for security issues. In the kernel only video drivers can be updated remotely (and support for this depends on the vendor).

I think it is a much better way to do security updates than the Apple model - security issues shouldn't have to wait for the next firmware update and for the user to apply them.

Some things moved into Google Play, which is a mixed blessing. On the upside, they may get updates longer. On the downside, there's an argument that moving things from AOSP into Google's proprietary blobs is not so great.