It's not as simple as that. Android may be open source, but Google can set the terms under which manufacturers can use the Android trademark and sell phones with access to the Play store and other Google services.

AFAIK they did amend those licenses to contain mandatory updates for some time after a device first hits the market, so it's definitely something they're actively trying to improve. It's probably not the easiest thing to solve, because manufacturers might decide to fork Android if they'd go too far, so they have to keep a balance.

I don't think this is true. Google could have handled Android licensing in such a way that resellers were required to patch security holes within a certain amount of time after release.

AOSP is a software license, and governs contributions and replication. The agreements whereby various vendors get rights to sell and distribute Android devices are between Google and the various vendors. If Google had so chosen they could have added conditions to those agreements whereby vendors would be required to apply security updates within some reasonable amount of time. They did not do so in order to increase their marketshare. This decision hurt the platform, at least insofar as security is concerned.

It was a choice: marketshare vs. security. Google chose marketshare.

AOSP is not a software license, AOSP is the name of the open source project (like chromium is to chrome), the license of AOSP is Apache Software License, Version 2.0 (and some GPL and LGPL stuff).

https://source.android.com/source/licenses.html

> not sure why especially on HN, people do not seem to understand or want to understand how open source licensing work.

Because they are partisans and the no-updating situation is a stick they can beat the Android with.