In modern Android phones, the core system is updated one a month [if needed - which is often the case during the first year]. Android applications (including things like mail and browser) and a large part of the OS is updated immediately via the store.

The permission system is being updated and apps are being rejected for bad user of permissions (check Reddit for the SMS permission stories)