I think they've learned their lessons since the first Galaxy.

It seems that there's much dependency on carriers and manufacturers in the Android world.

What if security related bugs are discovered? Are there minor updates to fix these? And how fast are they deployed by the carrier or manufacturer?

It is not entirely carriers' fault though. Samsung is yet to roll-out the update even in out countries like India, where carriers don't interfere with it at all.

To top it all off, they've disabled OTA and need a Windows only desktop software (Kies) to update the OS. The latest version of this doesn't upgrade even minor upgrades of the firmware.

A HN user suggested a workaround on another thread by downgrading the version of Kies. When I tried it, it didn't even show that a minor firmware upgrade was available.

While Galaxy is wonderful on the hardware side, it has miles to go with its software.

I agree, but that's generally true of hardware companies. Intel's software (other than their compiler) is terrible. I wish hardware companies would just agree on a standard and let the software companies (Apple, Microsoft, etc.) handle synchronization.

Yes, I know it is isn't as easy as that, but it would have to be better than the ghetto that is hardware company-supplied software.