Interesting, thanks for explaining!
My experience with Android is limited, but I assumed that new vulnerabilities were occasionally found and patched in the main open source project, and then those patches would get pulled into the forks being used for devices other than cell phones.
Perhaps the smaller scope of Qolysys’s fork of Android (i.e. no web browsing or app store) makes these vulnerabilities less frequent or urgent? I’d prefer if the panel would update automatically from the 4.3.0 (or 4.4.0) patch as needed, but I guess I can watch that firmware release thread for anything urgent.