Over the last few days GrapheneOS has been active on their socials regarding the state of AOSP. Google has essentially changed their entire development model, including developing in private. My theory, which GOS hasn't linked the changes to, are because of the recent EU legislation that recently came into effect:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AJOL_2023_214_R_0003
If you read 1.2 (6), it states:
Operating system updates:
(a) from the date of end of placement on the market to at least 5 years after that date, manufacturers, importers or authorised representatives shall, if they provide security updates, corrective updates or functionality updates to an operating system, make such updates available at no cost for all units of a product model with the same operating system;
(b) the requirement referred to in point (a) shall apply both to operating system updates offered voluntarily by manufacturers, importers or authorised representatives and to operating system updates provided to comply with Union law;
(c) security updates or corrective updates mentioned under point (a) need to be available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
(d) functionality updates mentioned under point (a) need to be available to the user at the latest 6 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand;
(e) an operating system update may combine security, corrective and functionality updates.
To me, this would make sense as to why Android is now private, and why Google, as GrapheneOS stated didn't push updates to AOSP. They are bound by this legislation that would then force OEMs to ship the updates within a set time frame.
It would therefore make sense, if the December 2025 patches were 'already done', to ship them in December 2025 (the first public release, triggering the 4 month legislative window), and therefore give OEMs until April 2026 to get them onto end devices. If the patches were completed say September 2025 (but not released until December), that would give about 7 months in total. The obvious downside being, as Graphene has already alluded to, attackers are also able to get access to these patches and use them maliciously. I also expect this is why there is an 'embargo' they have been talking about, as if it's released to the public, that would trigger the 4 month window (although, I am doubtful of any 'leak' being sufficient to trigger this legislation)
What seems bonkers is that OEMs are expected to provide updates for 5 years AFTER the device leaves the market. Google can do this by putting each Pixel on the market for 2 years, and discontiune the product, and provide another 5 years of updates (making the typical 7 total they already advertise).
However, for your average 200 euro basic smartphone is also expected to be given the same support window. If it was on the market for 1 year, they would be obligated to provide another 5 years of updates. As Kernel trees themselves are only supported for 4 years, I expect every device to have to update their kernel at least once (which historically has not happened).
So when GrapheneOS says that it's for 'marketing', I actually believe it's due to the new EU law. Google's hand has essentially been forced as there is legislation around functionality and security updates.