The real problem here is Android's inability to update what are considered 'OS components' independently of updating the OS. Ideally, the built-in browser (which should really just be Chrome) can be updated just like other apps can. Having a built-in browser and also Chrome for Android seems like it would confuse users, and not have the desired security impact you describe because it needs users to search for, install the browser and use it instead of the built-in version.
Google can update apps independently of the OS. Youtube, Gmail, Maps, Market - are all updated independently of the OS ever since Froyo.
They will eventually replace the stock browser with Chrome, but they're waiting until it's not beta anymore, and until ICS has bigger marketshare, or maybe they'll just make it the default browser starting with Android 5.0.
