Motorola can't commit to monthly security updates

Quality assurance of the security patches is definitely important; I don't think anyone is going to want an update on their phone if it will make their device unstable afterwards.

I would question though whether Motorola is actually incapable of keeping up with the monthly security updates (despite what they say). Samsung themselves is already committed to monthly security updates (source) with a far larger device line-up and an arguably more modified Android system ROM (compared to Motorola). This makes me rather skeptical of Motorola's self-assessment.

OEM's that can't commit to monthly security updates shouldn't be allowed to edit the OS in any way (no bloat apps, no changing systems, no locking bootloaders). They should provide the hardware and the drivers alone..

Carrier devices are all but impossible to hit the deadline, unless it's, say, a Galaxy S7 that the carrier is fast tracking updates to make their hottest new device look good. 45 days is about normal for an update to get certified by a carrier, and that's if nothing is wrong. If it is, it takes another two weeks or more from when it's fixed and resubmitted.

Nexus and unlocked devices don't deal with the carrier, so now that most have build strategies down pretty well, can integrate the patches and test and push the update in a week or so, if they put forth the effort. Samsung and HTC have been doing pretty good for unlocked devices of this and last year's flagships. Both have been ranging between 7-20 days from release by Google.

Carriers mess up the flow in having to patch custom versions, not to mention the carrier testing. Android manufacturers need to band together and stop selling carrier customized versions entirely. If carriers want to sell them, they have to sell the unmodified one. But really that will never work unless all manufacturers align.

Otherwise you'll get that one that wants to take advantage of the marketing gap. 

Source