Wrong. Many people, including myself, bought their device directly from Google, and Google themselves create and release the updates for these devices. You can install factory images directly from Google or wait for the over-thr-air updates.
I believe there are also carriers modified versions. For example, I think T-Mo has Nexus devices with proprietary WiFi calling added. In those cases then yes, the carrier must manage the update. Nexus program guidelines suggest how quickly carriers must release such updates.
Nevertheless, many people are on the Google-direct update train.
Google are really hit and miss with updates. They don't offer pre-releases to enthusiasts like they ought to (a pre-5.0 build was an exception and that's only because they were changing the runtime out and literally had to do it for dev support). They announce releases then don't roll them out to their most popular devices for weeks/months, and they release fix versions that don't address some of the worst bugs.
I like Android but my biggest gripe is not being in control of my own updates. When Apple announces a new OS everyone can get it. When Google announces a new OS you better pray you can get it a month later, and that the bug fix version won't be three months behind. That's if your device manufacturer even supports the update.