There's the WinSxS and the GAC (Global Assembly Cache). In SxS actually means side-by-side. Both WinSxS and the GAC supports multiple versions of the same libraries, and the program manifests set up policies for which library versions they require/accept.

An application may for instance say that it accepts any newer "minor" version.

For security patching you can replace a library with a new "build". So if an application uses libraries placed in WinSxS or the GAC it will pick up any centrally patched libraries without the risk of jumping to a too new version with breaking changes. The new version can exist alongside older versions and they can all be patched - for security reasons or otherwise.

A vendor can also distribute libraries alongside the application - in the application library itself. In that case the responsibility for patching is placed squarely on the vendor of that application.

Not sure who "they" is here, ut in windows: pretty much, yes. You can't have it both ways. So you either have a centralized/shared lib environment where you may run into conflicts but you get centralized patching, or you have self contained applications where you need to patch each one but you never have lib dependency/upgrade issues. Simple as that.