Hey, look: A new BlackBerry phone is here! And no, you didn't just wake up from a 12-year coma. I promise you, it is still 2018.

The new BlackBerry Key2, however, is aimed squarely at those who miss the glory days of the physical-keyboard-packin' phone — specifically, business users who still place some sort of value on the BlackBerry name (even if it's technically a different organization making the devices now). The company's own landing page for the device placards that focus plainly:

The page also makes the Key2's business-centric selling point pretty clear, claiming the device is "the most secure Android smartphone" — the most, dad gum it! — "with enhanced security and privacy features built-in."

There's just one problem with that statement and thus also with the broader narrative surrounding the Key2's launch: BlackBerry, as the company and most folks discussing it fail to mention, has an absolutely abysmal record of delivering Android operating system updates to customers.

And trust me: For any phone in 2018 — but especially for one being presented as a security-focused gadget for Serious Business Users™ — that's a liability you shouldn't ignore.

[Get fresh tips and insight in your inbox every Friday with JR's new Android Intelligence insider's newsletter. Exclusive extras await!]

Let's start with the cold, hard facts: BlackBerry's previous flagship phone, the KeyOne, came out in April of 2017.

This week — just today, in fact — the phone was scheduled to start receiving the Android 8.0 Oreo upgrade. That rollout has already been pushed back to next Thursday. Android 8.0 was released and made available to manufacturers in August of 2017, nearly a full year ago now (and that's to say nothing of the newer Android 8.1 update that followed last December).

If the current schedule stands, then, it will have taken BlackBerry a whopping 319 days — 10 and a half frickin' months! — to get that major operating system update onto its flagship-level, security-minded, business-friendly phone. And the update isn't even set to reach KeyOne device owners everywhere yet; it's scheduled to start rolling out only in Canada as of this moment.

Now, the KeyOne has, by most counts, gotten timely and regular security patches — and that certainly counts for something. But 10 and a half months for a major OS upgrade? No matter how you look at it, that's simply inexcusable.

And it isn't a fluke, either: BlackBerry received 0% "F" grades on my Upgrade Report Card analyses for both Nougat in 2017 and Marshmallow the year before. (I didn't include the company in my Oreo Report Card this year because of its diminished relevance in the Android ecosystem, but rest assured: The performance we're seeing now would have kept its 0% "F" streak going strong.)

OS updates provide foundational fixes and security-oriented enhancements

Why does this matter? Simple: Even if you set aside the feature additions and interface improvements introduced with most major Android releases, operating system updates contain a significant number of foundational fixes and security-oriented enhancements — things like the tightened-down APIs (programming interfaces that allow apps to interact with your device and data), strengthened backup data encryption, and emphasis on steering apps toward secure web transmissions included in the upcoming Android P update.

Similar under-the-hood improvements appeared in Oreo, including new restrictions on easily abused permissions, a more thorough method of verifying the operating system's integrity each time a phone boots, and a more effective system of sandboxing to keep critical parts of the software isolated from other processes.

It's precisely this sort of progress that illustrates why OS updates still matter, even if you aren't interested in the flashier front-facing stuff. No matter how much patching may be done — and no matter how much Google deconstructs Android in order to update elements of the software easily, frequently, and in a universal manner — certain foundational elements tied to performance, security, and privacy can be addressed only in the OS itself.

BlackBerry's commitment to providing timely security patches and its process of adding its own security enhancements into the software both deserve praise — no question there. But the company's lackluster effort at keeping its devices even semireasonably up to date with Android OS releases deserves an equal amount of attention.

That'd be true for any company selling a several-hundred-dollar phone, but it's especially true for a company that stakes its reputation on security and serving the business community.

Sign up for JR's weekly newsletter to get more practical tips, personal recommendations, and plain-English perspective on the news that matters.

[Android Intelligence videos at Computerworld]