How do Android devices receive security updates?
Android updates are given three basic classifications: major, minor, security. (I'm looking for a source for this, but I've been unable to find it thus far.)

Security upgrades, at least, are supposed to be part of the core code and have the least disruption to customizations the carrier and/or manufacturer have made.

However, it's still up to the carrier and/or manufacturer to take the update and incorporate it into their particular flavor of the OS. Some are better at it than others.