How and when is Android's default browser updated?
You are correct. The built-in browser is only updated when a full new ROM is installed. If there is an exploit, the only thing to do is wait for a new version of the OS to be released. Alternatively, you can use a third-party browser such as Opera or Google Chrome. Those are installed as apps and can receive updates independently. 

As far as I know, there is no documented version history for the native browser. The best you could do is look at the GIT revision history for the browser.