Almost all attack services are now updated remotely by Google for security issues. In the kernel only video drivers can be updated remotely (and support for this depends on the vendor).

I think it is a much better way to do security updates than the Apple model - security issues shouldn't have to wait for the next firmware update and for the user to apply them.