Though yes , buying an android handset does put you at the hands of the manufacturer when it comes to updates and support. Though you will find that many of these handsets run a final version of the last supported os, which is in fact more secure and stable than a brand new flagship handset with latest OS. When it comes to bugs and security, running the latest version of a new OS is the most dangerous, hence why big organisations never run the current OS, but a generation or two behind.