Re: "it needs to push carriers to push over-the-air updates promptly after fixes become available."
"Whilst it's possible carriers have redirected this, most of them don't bother fiddling with the system partition,"
Actually, most of them do. I know at least half of the UK networks run the OTA servers for their phones in-house, and it's there that the updates push from; it's probably more than that. The device manufacturers are, after all, using the network provider's bandwidth to push the updates - and a 2gig download to 30 million mobiles is a LOT of bandwidth to allow someone else to randomly use whenever they feel like it.