As the Android ecosystem is somewhat decentralized, it's mostly up to the manufacturer to release firmware updates. I say "mostly" because there is an in-band "carrier certification" process that applies to most devices in the United States, at least, and the carriers have been known to deny updates in the past.
Updates can be distributed however the manufacturers wish. For Nexus devices, Google distributes binary patches between point releases, and makes full system images available for restoration. Some manufacturers, notably HTC, have distributed some firmware updates as a full 1GB+ system image, and minor updates as patches.
Very rarely has Google pushed a point release in direct response to a security bug. The most recent that comes to mind was a patch to fix the master key vulnerability; it may have been 4.2.1 or 4.4.1, I don't remember.
Typically, manufacturers don't distribute security updates on their own. The release process usually follows a point release upstream. They build a device tree, merge whatever system customization, UI layers, and bundled applications they maintain, perform extensive testing to make sure they haven't broken something that was changed upstream, go through rounds of carrier certification, and finally the update is pushed as an optional OTA to devices.
For these reasons, it is difficult and expensive to distribute security patches to older, non-supported devices. I'm not going to comment on Google's share of any blame for this process.