OEMs get early access to the patches and are allowed to push them on their OS, but no one does them all. Google and Samsung do a small amount of them. Since they are embargoed and not open source immediately, they aren't released into AOSP until months later with their scheduled security patch level.
