While I agree with you, the first step for user centric Android flavors regarding security is to support relocking the bootloader, with a custom (preferably the user’s own) digital signature. As long as we dont have that, an attacker could flash or just boot a custom bootloader through fastboot that does its own thing.

However that doesn’t really depend on Android system developers, I think, as the problem arises from the inferiority of almost every phone’s bootloader (chain) (because most phones does not support setting up a custom signature for bootloader verification), and probably that can only be reasonably solved by device manufacturers, because as I understand, bootloaders do a lot of heavily device specific things, so there cant really be a common (primary) bootloader, and making one for each phone is a lot of work that also involves lots of reverse engineering, and maybe the early bootloaders cant even be overwritten on some phones…

Which is a fraction of a fraction of Android users.

I’m all for de Googling if that’s what tickles your fancy, but ask anyone on the street and they’ll have no idea what you’re talking about

Edit: This also allows Google to push some of these features to older devices which may not ever see another system update