I've got a Pixel phone from Google, but it really doesn't matter, I guess the question would apply to any AOSP-based device. They state that they provide 3 years of version updates and security patches.
I've got an update notification on my phone that it's ready to update to the next Android version (11), but the point is that I don't want to switch, I want to stay on my beloved old version that I'm used to, yet still I want to get security patches to keep my phone safe and bug-free. When looking at Android security bulletin page I see a list of bugfixes and the Android versions they apply to, and some of them span as far as 4 versions back, which practically means the manufacturer is theoretically able to release a patch for my Android version. Thus, I'd like to understand:
What's the Android release lifecycle when it comes to pushing new Android versions and releasing security patches? What role does Google Play system update play in this?
My current situation: Android 10, security patch level - Aug 5, Google Play system update - Sep 1. When clicking on Pixel security bulletin link, nowhere is mentioned that the security patch would apply specifically to version 10 or 11, it just lists the bugfixes.
Does this mean that it's assumed the user would be running the latest Android version, and the patches are built against that latest version he was supposed to have, and he won't be able to receive those unless he upgrades the Android version?