How do Android devices receive security updates? I'm new to Android and I'm thinking about buying an entry-level Android device.

Yesterday I read that Android passwords are stored in plain text. That got me to thinking... how do Android devices get security updates? I know that OS upgrades aren't available to every Android phone, so I was wondering how vulnerabilities like these will be patched. Does it depend on the goodwill carriers?
Android updates are given three basic classifications: major, minor, security. (I'm looking for a source for this, but I've been unable to find it thus far.)

Security upgrades, at least, are supposed to be part of the core code and have the least disruption to customizations the carrier and/or manufacturer have made.

However, it's still up to the carrier and/or manufacturer to take the update and incorporate it into their particular flavor of the OS. Some are better at it than others.