Aren't many core components now taken care of by the Google Play Services library that's updated separately to avoid carriers and manufacturers from delaying critical security updates because they need to package and test these with all their bloatware crap?

Play services do not get just security updates, that’s true. It’s pretty hard to not have that up to date on an Android phone anyway.