That assumes that you can make enough consumers with these (relatively) older devices care loud enough for any "pressure" to be applied to the manufacturers.

Security updates aren't sexy and don't get applied unless they include shiny things along with them.

Right now, the customers have zero power because Google and the manufacturer simply point fingers at each other as to who's to blame.

Releasing the update gives the customer power to press for pushing their manufacturers.

The whole model where carriers or manufacturers can send updates is ridiculous. Carriers update baseband. Manufacturers should defer to google for Core OS updates and Google Play. The fact that they're even involved is simply a recipe for disappointment.

It's bad for everyone because compromised machines simply reward and embolden the criminals which will eventually increase the harm to everyone who ins't a criminal.

No. They are not all at fault. The only one's responsible for updating their phones are the companies supplying the phones. There is nothing stopping Samsung, Sony, HTC, LG from creating and submitting a patch to AOSP and they are the ones who actually have a responsibility to their customers to do so. There is also very little stopping them from updating their phones to 4.4.

> is really all Google's fault because they let the carriers get away with it and have never reigned them in even after years of incompetence on the carriers' part.

You are again blaming Google for the carriers policy of updating phones not even belonging to Google. Do you really think Google is involved with a carriers agreement to carry Samsung phones?

Last time I checked, Nexus phone's can also be updated without the assistance of the carrier.