Also the Pixel updates are still held back by phone companies. If they cared about updates or security they would update their phones directly like Apple.
Updates are all pushed at the same time when Verizon okays it. They don't want to be on the hook for any regulatory issues like E-911 problems so they test it. They also don't test security updates, only major updates.
I've not seen any updates held back by my carrier (unless, I guess, they don't send them out to anyone until all of the phone companies agree on them). As far as I've seen, I get my ~monthly security patches over the air from Google when the rolling updates hit my phone or I get impatient for an important one and just download it from Google myself.
I don't know if they have the direct leverage they need. They'd have to force the manufacturers to fight for it if/when their contract negotiations with carriers occur again.