I'm going to respond to my own question here to synthesize all my findings and the answers by @Agemen and @Kowser above.
- OpenJDK is a reference implementation and does not change unless the spec changes
- There is an OpenJDK update project which implements all updates in source (http://openjdk.java.net/projects/jdk7u/, source http://hg.openjdk.java.net/jdk7u/jdk7u-dev)
- OpenJDK will not provide any compiled or packaged updates. In fact, OpenJDK provided binaries for the initial release just as a convenience.
- It is the responsibility of third party OS/distributors to compile and package Java. E.g. RedHat and Ubuntu
- No third party has yet released updates for Java 7
- These third parties typically use IcedTea to do the compilation and packaging, but IcedTea itself does not do so. http://icedtea.classpath.org/wiki/Main_Page
We now have a combination of things that are making usage of Java really painful in open source server deployment
- Oracle JDK has updates (including security fixes) that no OpenJDK package has. This makes using anything other than Oracle JDK result in poorer security
- Oracle JDK can no longer be packaged distributed by third parties (e.g. Ubuntu). Now we have to install it by hand or script it, and maintain it, on all our servers.
I just don't get it...
Marc
EDIT
As @Krige pointed out, things seems to have finally kicked into gear with OpenJDK builds available with the latest updates!