There are some questions often asked about Android updates like how do Android devices get security updates, OS upgrades are not available to old Android phones and how vulnerabilities are patched with these updates.
Android updates have three basic classifications as major, minor and security. Security upgrades are generally supposed to be part of the core operating system code and have the least modifications to customizations the carrier or manufacturer have made to Android OS code.
However, it still depends on the carrier or manufacturer to take the update and apply it into their particular version of the Android in selected smartphones.
Manufacturers of mobile phones have to be involved in these upgrades, because they have their own customizations to Android which has to be checked before applying OS update. MIUI, OxygenOS are examples of customized operating systems.
Firmware updates are mostly secure and update the actual OS only after user confirmation. To detect tampering, these updates are signed and the signature is verified before install. After a required confirmation from user that the installation should start, after a reboot, the recovery program will first verify this signature and then it install the new firmware to mobile device.
Make sure the phone battery is charged and back up important data before applying update to the phone. In case of major version upgrade, update should be applied when phone is connected to Wifi or high speed internet connection.