They should at least be shipping monthly updates with the months security updates. Well some months have not had any since Google is now trying to batch them to be quarterly because OEMs couldn't keep up with monthly security fixes.

Nah, they can break stuff any time they feel like it. Just like before. They were never limited to following AOSP updates, just look at all the garbage they add on top. Now they just have an excuse to sit on stuff for longer if they don't feel like doing anything.