You can (and manufacturers do) release security updates for past major-version releases without backporting features.
At least for Android that's not a big deal as most of the system lives in independent applications.
At least for Android that's not a big deal as most of the system lives in independent applications.