Updates...not as simple as that...
It depends on the device. The Nexus S is a Google sponsored phone, running stock Android which is aimed at developers mainly, so the updates come straight from Google and it should always have the latest version of Android. The Nexus One is the same.
With devices like the HTC Desire, Desire HD, Samsung Galaxy S, <insert random Android device here>, the updates come from the manufacturer, not Google. The manufacturers are not forced to update the devices, so many devices end up being either abandoned, or don't receive updates in a timely manner and end up being stuck on an old, insecure version.
I expect most of it is down to commercial reasons, why should manufacturers update their existing devices when you can force people to upgrade by abandoning them.
Take the HTC Desire for example, it's been 6 months now since the Android 2.3 (Gingerbread) source was made public, and HTC still have not released a 2.3 update for the Desire, and HTC get the source *long* before it is made public.
There are 2 ways you can ensure you will always have the latest, most secure version of Android. Buy a device sponsored by Google, such as the Nexus S.
Or...do what I do, root your device and build your own ROM from the latest Android source, it's not *that* hard to do.