The attestation.app service now has initial support for split system, vendor and boot patch levels. This was introduced with key attestation v3 on the Pixel 3 since they're allowed to be updated independently and aren't actually guaranteed to have the same patch level.
Conversation
The implementation of this feature doesn't appear to be finished in the OS. The vendor image is from PQ1A.181105.017.A1 and is marked as 2018-09 despite it being part of the 2018-11 patch level. Build.VERSION.SECURITY_PATCH doesn't take the boot/vendor image into account yet.