Google’s August security patch went out to Pixel 8 and newer. Pixel 6 and 7 got nothing. The Pixel 6 is two months out from the October end-of-life date Google itself confirmed. The Pixel 7 has over a year of committed support left. No explanation has been offered, and I wouldn’t be surprised none is coming. Instead I would ask who is supposed to be maintaining these phones.

In last year’s Computerworld Android upgrade report card, Google scored a perfect 100%. Android 16 reached current, previous and two generations back flagships on day zero. It’s the best in the category, the only vendor JR Raphael credits with making an explicit guarantee part of the purchase. And it still dropped a month.

Apple is a phone company in the traditional sense. It sells the hardware and writes the software that runs on it, so when an iPhone stops getting patches there’s one company to point at. Which is why its published five-year minimum from UK is a floor, not a ceiling — Apple routinely patched older iPhones, the iPhone 6s nine years after launch.

Android was never built that way. The manufacturer sells you hardware and takes the position that it didn’t sell you the software. It just put Android on the thing. That disclaimer is baked into the model, which is how Samsung can post 81%, then 0%, then 76% across three consecutive report cards and still stay the most popular Android manufacturer in the US. Google is the one Android vendor which seemingly has access to Android the way Apple does. Except Google argues that as Android is open source and its reference model is not Pixel, its access to the OS is no more privileged than anyone else’s. So it dropped the patch and Pixel.

Buy a mini PC and nobody blinks when you wipe it. BYOI is the expectation, and firmware updates keep coming regardless. A smartphone isn’t that. You’d think Apple’s walled garden is what keeps people in, but Google’s glass house does the same job with better scenery. GrapheneOS puts it flatly: it cannot provide a secure device once firmware, kernel and vendor code stop being maintained. What it ships after that are “harm reduction releases” — incomplete patches, meant to buy users limited time to migrate. “Then just fork it,” the standing answer to any abandoned Linux project, doesn’t survive contact with a phone.

Linux settled the same inconvenient question decades ago. Raspberry Pi OS still boots a fourteen-year-old Pi on a current kernel, because Raspberry Pi pays engineers to keep it that way. Synology does the same for DSM, which it guards as proprietary secret sauce and maintains for a decade or more past the sale. Android is nominally under the same license as the Pi. But it behaves like DSM.

Treat every hardware sale as final. That’s the rule of thumb — a laptop’s sale is final too. What’s brazen is selling the openness alongside it. Android is public, the boot loader unlocks, the community is willing. None of it survives Google losing interest.