Many Android devices, including the Google Nexus line, are now receiving monthly security patches via OTA updates, accompanied by the Android Security Bulletins. However, these updates are often released in what is known as "staggered roll outs," where the update is available for more devices (of the same model) over time, instead of becoming available to all users instantaneously.

I understand that for feature updates, gradual roll outs allow errors or bugs to be fixed before all users receive the new software. However, for security patches, wouldn't a staggered release make it much easier for blackhat hackers to utilize the now-public vulnerabilities against users whose devices have not yet received the OTA, even though a patch for their device model is already available?

For example, I have a Google Nexus phone that is supposed to be among the first to receive all Android updates. The latest Android security update was publicly released on May 4, 2016, along with its source code; it is already May 16, 2016, and my Nexus device is still telling me that my "system is up to date," even when I click the "check for update" button. Of course, I can manually download the latest firmware images and flash it manually; but shouldn't security updates be made available to all devices of the same model as quickly as possible once it becomes public?

Edit: Thank you for the very thoughtful responses. While this question is intended to be widely applicable to different devices, my specific concern is the intentional "staggered roll out" to identical devices of the same model, once a patch has already been developed for that specific model. For example, the May 2016 security update has been released for the Google Nexus 6P at the beginning of the month, but as of May 16 not all Nexus 6P devices have received the OTA update. Google releases security patches for Nexus devices every month, and each month some devices receive them a few weeks later than other devices of the same model. 

Excellent question.

Yes, your understanding is correct, as well as your rationale behind it.

Staggering roll outs for new features often makes good sense.

Staggering roll outs for security patches rarely is a good idea.  As you pointed out, this gives even more opportunity for the vulnerabilities to be exploited.  Perhaps even more importantly, the patches can be quickly reverse engineered to develop exploits in a rapid fashion.

Microsoft often publicly releases their patches on the second Tuesday of the month (and also sometimes on the fourth Tuesday).  This has commonly been referred to as "Patch Tuesday".  There's a reason we call the next day "Exploit Wednesday".

It's unfortunate that a significant chunk of the Android ecosystem has not learned from this phenomenon.

Updates:
Several knowledgeable people have pointed out potential impact on internet infrastructure, including fears of overloading the entire internet.  The volume of internet traffic is monumental; security patches, even extremely large ones, are tiny drops in the bucket.  Microsoft releases large patches to hundreds of millions of users on the same day each month, and they have yet to "crash the internet".  Netflix, YouTube, and Twitch stream videos to millions of people every day, and even with their combined traffic, they have yet to "crash the internet".

On the other hand, Android patches are predominately (but not exclusively) delivered to wireless users.  There are solutions to any potential issues:


Provide users with a choice of when to download the patches.  This provides numerous benefits:


Does not disrupt the user's workflow
Creates traffic staggering due to human interaction and decision variability
Allows the user to wait until they are connected to a higher bandwidth system (perhaps at work, their university, at home WiFi)
Allows the user, at their own risk, to wait and see if others report problems with the patches

When distributing patches to specific regions known to have limited infrastructure that could be impacted, stagger the patches over the minimal number of days to avoid overloading infrastructure.


In regards to specifically the Google Nexus 6P security updates not being released to all users promptly, that's simply a poor choice by Google that is not in the best interest of their customers.  Compared to the massive volume of internet traffic, those patches are minuscule.

On top of that, that device is relatively rare in the Android ecosystem.    This further supports the statement that releasing the patches to all customers at once would not harm any internet providers.

Even the entire Google Nexus product line comprises only a tiny part of the Android world.  As a product line, however, there could be a little impact on infrastructure in select regions.  As such, the following methodology, while combined with the recommendations outlined above, will minimize infrastructure impact while maximizing patch distribution:


Release zero-day exploit patches immediately
Release scheduled updates on different days each month, a different day for each product
If a product has significant market share that could reasonably impact infrastructure in a region, stagger the roll out over the minimal number of days required to avoid infrastructure overload in that region only


Finally, according to your statements, it has been over two weeks since Google initially released those patches for the Google Nexus 6P.  That's more than enough time to know if their patches are causing havoc.  I have found no documentation from Google recognizing or apologizing for a bad bunch of patches, nor anecdotal evidence of any serious problems.  

One could make the argument that staggering patches out over a few days could possibly be reasonable in order to detect flawed patches and to reduce traffic load.  But leaving customers unpatched for weeks is unreasonable, unnecessary, and not an effective policy from an information security standpoint.

In conclusion, based on the statements above, and your statement that Google has not rolled out the security patches to your device, my conclusion is that Google, by not delivering security patches to all affected Google Nexus 6P customers, is making a poor decision and is doing a disservice to their customers.
