may be true for the Ubuntu MATE distribution, but Arch and the recent Raspbian releases do kernel updates as part of "upgrade". Former Raspbian releases required a "dist-upgrade".
The current Raspbian cache contains:-
is unfortunately true. While https://github.com/raspberrypi/firmware contains kernels the process by which the Foundation decides a stable release is a mystery. Generally the kernel in the Foundation releases is quite stable.
is true, although it is possible to swap kernels using the "kernel=" parameter in config.txt.
The above seems to be an artefact of rpi-update, which is not intended for ordinary users, although for Ubuntu MATE this seems to be the only option.
Indeed the Foundation engineers warn about this "In normal circumstances there is NEVER a need to run rpi-update as it always gets you to the leading edge firmware and kernel and because that may be a testing version it could leave your RPi unbootable". https://www.raspberrypi.org/forums/viewtopic.php?p=916911#p916911
Arch and the recent Raspbian releases do not leave "ever-accumulating detritus" (although the Former Raspbian releases did leave older modules).
I don't know where this came from, I do not see it in my /boot/config.txt. kernel.img is the ARM6 kernel, so by definition unused by Ubuntu. Mind you , there seems to be no reason to remove it.