If they don't release the security fix this month, I write to Google and tell Xiaomi Mi A3 can be removed from their list of "Android One" phones, since a requirement for it is monthly security updates.
Anrdoid One