Apple can control or at least heavily influence the updates for Snow Leopard. It can't for flash.
Apple handles the SDL for its own security flaws internally. It tends to know where it stands with them. Apple cannot say the same thing about Flash; Adobe (as a simple matter of course) may have tens of queued vulnerabilities, with some arbitrary subset of them having actual fixes in the pipe. That's the nature of software security on large projects.
Apple can't wash its hands of Snow Leopard vulnerabilities, but it essentially can do that for 3rd party software like Flash.
Apple ships plenty of GNU code. What if an exploit is released between RTM and the ship date? That's the kind of thing I am thinking of.
But I don't disagree that this is Apple saying "this is somebody else's problem now". I just wonder if that somebody is Adobe or the end-user.