That's really great! I'm glad that you can do that.
But (and I'm sure this will be an unpopular sentiment) you realize that it doesn't fully address the article's concerns about security. Nor does it provide the experience people expect from tested manufacturer updates (which are far from perfect, but still). This is not the same thing as manufacturer support. You could provide that level of support even as a third party, but it would be a lot more work and it would require the cooperation of Qualcomm and other vendors. You'd need to start a company and charge for your work to make it feasible.
Well, I'd say the existence of phh's ability to do this despite being in an environment that's unsupportive (or even hostile) is proof the model works. It would flourish with a regulatory bump keeping the manufacturers in check and unable to continue this poor support lifecycle.
This is about their profits. It's not about security, environmental responsibility, or the users. Regulatory authority exists to promote the interests of the people when the interests of the corporation's profits conflict with them.
But (and I'm sure this will be an unpopular sentiment) you realize that it doesn't fully address the article's concerns about security. Nor does it provide the experience people expect from tested manufacturer updates (which are far from perfect, but still). This is not the same thing as manufacturer support. You could provide that level of support even as a third party, but it would be a lot more work and it would require the cooperation of Qualcomm and other vendors. You'd need to start a company and charge for your work to make it feasible.