Google develops Android, but vendors fork Android. Google can’t update Samsung’s Android because they’re not the same code base. The situation is not dissimilar to the relationship between Debian and Pop_OS, or Arch and CachyOS. Google (Debian, Arch) can patch their repos and distribution, but if Pop and Cachy update their copies, their users won’t get any updates.

Out of frustration about this, Google is pulling more and more stuff into Google Play Services, like the Chrome runtime, the location framework, contact tracing, you name it. Many open source enthusiasts absolutely hate that, but it’s a direct result of vendors not applying freely available patches to their ROMs.

Google offered (and to some extent still offers) to make updates for vendors, but almost nobody bought phones that came with their ROMs. Vendors didn’t want Google’s ROM because their software is the only reason to pick their glass bricks over their competitor’s. That’s why only cheap, pretty shit budget phones still carry Google’s ROM these days.

With GSIs, Google did actually write a HAL that should make binary drivers compatible across versions. The custom ROM I’m currently using doesn’t even seem to package these drivers, they’re left in the /vendor partition and loaded like normal. Some drivers need to be linked against the specific kernel because they’re devices Google hasn’t thought to make an abstraction layer for yet, but things like camera drivers are now decoupled.

This is why GSIs exist in the first place. Unfortunately, the lack of upstream kernel code from companies like Qualcomm means that power management and some other hardware is completely broken if you just flash a GSI on a random phone.

A big problem with specifically Samsung phones is that Samsung refuses to load their camera firmware if you’ve unlocked the bootloader on some phones. The entire OS is designed to make the camera work regardless of ROM image, but Samsung chooses to sabotage alternative ROMs anyway. Google can’t fix that.