Wait some bugs are security issues and cant be patched unless a full upgrade is performed so no the discussion is how do we keep people protected when they cann

Wait some bugs are security issues and cant be patched unless a full upgrade is performed so no the discussion is how do we keep people protected when they cannot upgrade the phone. I apologize if I am missing something but it my understanding Android relies on the carriers to push the updates, correct?