- What are they?
They’re monthly updates to AOSP (Android Open-Source Project), they usually include patches to fix bugs that arose, submit security fixes to render some exploits useless, or add mini/small features.
- Who Makes them?
These patches are usually made by Google and their Developers, and are handled & reviewed by them, but everyone can submit patches, usually OEMs & ODMs do that to contribute to AOSP or ensure compatibility with some of their products
- Rule of Thumb?
Security patches are important, you should update monthly to avoid security risks or compromise your data.