Who services the additional browsers?

So let's say we have a choice of browsers and these browsers are on the installation media. What happens when there are security vulnerabilities in those browsers? Do Microsoft update them before giving the user the choice? And how do you get to be on the list? Think of all the malware / badware browsers that could suddenly want to be on the list.

And how do ISVs even begun to deal with this? The cost of additional validation testing required will far exceed the revenues of Opera.