I was thinking that "subject to the approval of the carriers" was a legal requirement, along the lines of anything that could alter the operation of the radio would have to be approved. The hope being that a thin layer that deals directly with the hardware could be subject to approval, but the rest of the stack could be updated without approval.
On further reflection, I suspect it's more of a contractual obligation, and that neither party is all that interested in keeping 6 month old phones up to date. It's a shame, because Android developers can't reasonably expect ICS to be widespread for at least a year or longer.