> If there was a serious security vulnerability in one version of the software, would users be stuck waiting six months (or possibly forever) to get a patch?

They'd probably have to release security fixes for each of the currently active major versions. (Which is probably all of them.) Having the carriers be responsible for pushing security fixes would hardly make it a quick update though.