From Android 8.0 onwards the OS is separate from the vendor layer. You could install a GSI of Android 9.0 now and it would work apart from the usual 9.0 bugs. The issue is eliminating those bugs, and now importantly updating the vendor layer etc to 9.0, which requires a lot more testing. It's as much the vendor layer that will be in beta as it will be the OS. Technically as long as the vendor layer is updated and it's done correctly the security updates could be applied universally. Only vendor or driver updates would require a separate update. Realistically they should be applied separately anyway seeing as MR releases don't occur every month. User is happy being updated and it should be easier for Nokia.