Google has indeed moved a LOT of things to Play Services.

I should also mention the support library. I can now use some new niceties like vector assets on all Android versions.

However, not everything is part of play services. You can patch some security holes through play services, but some core elements of the platform need a full system update (however Play Services can detect apps trying to exploit a security flaw).

Also, in order to add something like the new permission model or a better version of the runtime, an OS update is still necessary.