EDIT: I kinda wish replies were more obvious, I 100% think this is an issue, the first bit is just a reply to a previous comment before starting on a tangent.
This is mostly a non-issue, Google doesn’t include most of their magic sauce in the open source AOSP image these are based on. I have a Google Pixel 2 from 2017 that I’ve installed an Android 14 GSI image (from Project Treble, another Google project to help standardize the base image to make it easier for people like Mudita to make a custom image) on and it runs perfectly fine because you’re getting the absolute bare bones to get a phone booted up. Project Treble was announced in 2017, so if Mudita built to this standard then while it would take considerable effort, it wouldn’t require rebuilding an entirely custom OS to update. If Mudita did not build with Project Treble in mind, they did themselves and their customers a great disservice regarding the ease of maintaining future updates.
I’ve been on the hunt a good while looking for a device that checks all the boxes the MK does, being limited to keep me off of it but capable enough to enable me to get things done. So maybe in my excitement I missed where it said somewhere that it was build in Android 12 but if I had caught that I would have passed on it with great disappointment as another device that was so close to perfect. After goofing around with sideloading a different launcher and seeing how much of the base AOSP ROM is hanging out in the background, I don’t think all the people claiming that it doesn’t have X or Y have any idea they’re most likely just as vulnerable as anyone else as it would indeed be a huge lift for Mudita to bear the weight of pushing their own security updates instead of “just” updating the base to a newer version.
Having said all that, I own the device now and I’m going to keep it, really rooting for Mudita to quell the paranoia of myself and others but if they don’t I’ll probably end up attempting to install a newer GSI image myself (it will go poorly, I am under no delusions that I could do better than Mudita, I write code for my basic needs but I am no dev, but it’ll be fun regardless).