Security updates don’t address vulnerabilities that result from a device being used in a way that it wasn’t intended, or that might compromise its security. For example:
Devices that aren’t properly factory reset before being given to someone else
Accounts that don’t use 2-step verification
Devices made by other manufacturers that haven't been assessed by Google and may have access to your network and Google Nest devices