aosp code used to be released all in one lump sum at new version launch and Google has actually changed that to being quarterly releases which takes a lot of burden off android based os devs. so things are actively going in the opposite direction you’ve hypothesized here.
security in obscurity is a farce. if your system fails upon techniques being revealed, it’s not very secure.