To the extent that Apple depends on (say) Ruby, then they own the system ruby and have a responsibility to keep it up to date. So, for instance, when someone finds an Apache flaw, Apple has to bundle a security update for it, and may even have to alter ship dates to account for it.

To the extent that Apple can decide that it does not depend on, say, Flash, then it makes sense for them to not to ship it. If they ship it, they own it, they have to fix it. If they don't ship it, they don't own it, and the vendor has to fix it. Which, in Adobe's case, makes perfect sense; Adobe's security flaws should not be Apple's problem if they don't have to be.