1. What are they?
    They’re monthly updates to AOSP (Android Open-Source Project), they usually include patches to fix bugs that arose, submit security fixes to render some exploits useless, or add mini/small features.
  2. Who Makes them?
    These patches are usually made by Google and their Developers, and are handled & reviewed by them, but everyone can submit patches, usually OEMs & ODMs do that to contribute to AOSP or ensure compatibility with some of their products
  3. Rule of Thumb?
    Security patches are important, you should update monthly to avoid security risks or compromise your data.