For example if a critical vulnerability is found in Jelly Bean would it get a patch, or is the expectation that users should upgrade to KitKat to be more secure?
Does Android even have the concept of individual/incremental security patches, or are Maintenance Releases (MR) the only way to get patches?
I found a comment here, but would like confirmation (with source if possible)...
The following is an excerpt from http://developer.android.com/guide/faq/security.html#fixes
The manufacturer of each device is responsible for distributing software upgrades for it, including security fixes. Many devices will update themselves automatically with software downloaded "over the air", while some devices require the user to upgrade them manually.
Google provides software updates for a number of Android devices, including the Nexus series of devices, using an "over the air" (OTA) update. These updates may include security fixes as well as new features.
If your worried about vulnerabilities in Android, you should be running the latest update on your device. Which would be KitKat, until L (lemon) is released across the board.
Remain conscientious when using your device.
Although I found evidence alluding to supported versions of Android, nothing was conclusive. It seems Gingerbread and up will continue to receive updates. Gingerbread is still being released on new devices, so development isn't discontinued.
It is generally expected that users would upgrade to the highest version of Android available to them, so Google do not release updates to previous firmware versions. However, Samsung occasionally release security updates independently of Google to older models. It's also worth noting that a number of security issues are within apps and not Android itself, which the user is able to update via the Play Store.
