I believe they're attempting to do this by separating some of the apps from the Android framework so that they can update them independently. Unfortunately, since Android is just so different from device to device, it'd be incredibly difficult to make a single change that can be given to all devices.

And there was a partial fix for this in 2.3 as the other poster has correctly noted, and Google believed they had fixed it, but it turns out that it is still exploitable.