I am somewhat confused in terms of how secure Android OS is and how updates work on Android. Are there security fixes on each release? How can I keep track for Android exploits and what are the most common attack vectors for Android devices. Any decent books on Android Security?
All the apps on an Android device have their own updates, which are then fed to the devices through the normal app channels (say, Google Play). This covers not only the apps you have downloaded, but also the apps which were provided with your device (I know that my phone regularly nags me about an update for the Facebook app which came with the device OS).
As for the core of the OS... well, it is more a "do nothing and pray" situation. If some remotely exploitable hole is found in the kernel for an OS version, then we are all doomed. Theoretically, the device manufacturer is responsible for pushing updates to users, and some devices include an automatic check to download new updates on a regular basis. At least so says the FAQ. But it is well-known that a lot of not-so-new devices are simply abandoned by their vendors, left to fend from themselves in a harsh wilderness. My phone uses Android 2.2 and I never saw it download a core OS update; maybe it is all transparent, but somehow I doubt it.
Android devices often don't get updates or are very slow to get them. They are naturally a more locked down ecosystem however and don't give nearly the same level of access to applications unless rooted. Some exploits do exist for an application to get root for itself, but it's generally a fairly involved process that is difficult to externally exploit without the user pushing it through.
Typically, if updates do ever make it, they take months or even years to get to most people's devices.