This isn't true for stuff like the video playback libraries hit by "stagefright". For some reason Google couldn't simply ship a fixed library. I read that it was because the update process doesn't have sufficient rights.