Android security patches and updates EE or phone mfr

[#1]

EE seem to have a bit of  reputation when it comes to the important question of security patches and Android updates.

My impression has always been that patches to existing installed versions - security updates/bug fixes etc. come from the phone mfr, but version updates e.g. Android 5.0 to Android 6.0 come via the carrier. I understand that version updates require a lot of testing to ensure that preinstalled bloatware will still work and that carrier supplied phones won't break as a result of carrier supplied version updates.

This may be complicated by the phone branding - for example a Vodaphone branded LG as opposed to an unbranded/unlocked from new handset. I have never had any issues with OTA updates and upgrades on unlocked but I am concerned that using EE/PN may result in security patches not reaching a phone.

[#2]

It depends on who you bought the phone from, if you get it form the manufacturer they will push out OTA updates as and when they are available. If you bought it from a phone company they often add extras into so will take time to add their stuff in before releasing it.

[#3]

Fairly certain that security patches come from the manufacturer not the carrier. Bloatware doesn't come into it because they're usually small downloads that have no bearing on the installed apps.

My Vodafone SU6 has just had a security update in the last couple of weeks but it's dated 2016-05-01

This may be for an update to MM shortly mind.