Unfortunately they're not propagated through different channels
In a reasonable OS, e.g., Debian, they are.
Not every OS is connected to the internet...
Not every OS connected to the internet can afford the risks of bad updates (which are far more common than proponents think/claim)
Debian package management doesn't have to rely on an internet connection. You could have the source of the security updates be a cd or USB stick or something with no problems