This reliance on OS updates is a really big problem for devices that rarely receive any, like Android phones. As an Android developer in Russia who worked on a very popular app when our government changed timezones, and then did it once again a year later, I wasn't thrilled. People started doing the silliest thing: instead of picking a timezone with the correct offset, they just set the time to read correctly, thus shifting the unixtime by an hour. They then proceeded to complain that my app doesn't show relative dates correctly (I just posted it but it says hour ago). Had to add an ugly workaround involving getting the known-correct current unixtime from the server and using the offset from that in all my time calculations. Fun times.

And no, you can't update the timezone database yourself. It resides on the system partition which requires root or at least an unlocked bootloader to mount as writable.