There are two problems: the length of time for which OEM's should be obliged to provide security updates and the frequency at which such updates are released.
This is separate to the issue of major Android releases. So just as with other software products, a security update isn't necessarily an update to the next major version. Hence whilst a vendor may patch KitKat (the version of Android shipped with the handset), there is no obligation on them upgrading it to Lollipop or Marshmallow.
I find it interesting that the DCA are going after Samsung and not Apple...
Biting the hand that feeds IT
