Yeah, why they don't enforce this is baffling. I can give them a break for letting their OEM's take their time with OS updates, but not requiring their OEM's to issue security patches is negligent.
Yeah, it's not like Samsung can go make iOS phones. And I highly doubt any of these hardware OEMs could possibly pull off a software project that doesn't suck, let alone a whole OS and dev ecosystem.
Samsung already releases phones running Tizen to have a side bet against Android. The quality of software is not very important when your only competitor builds phones that are significantly more expensive.