Correct, apple can either release a phone with perfect software with no bugs, or continue to provide bug fixes (security vulnerabilities are bugs). This is totally orthogonal to letting the owner of the phone run whatever software he wants. As windows has shown, it is quite possible.