Applications need no security updates if designed correctly in the first place. Think like a Palm Pilot, or one of those fancy laptop style word processors that had 5 built in apps that were popular back in the early 90s before EVERYONE had PCs.
If the web browser has no capabilities besides print, save, and view then it doesn't NEED security updates. The fact that Microsoft's browser has the ability to do EVERYTHING and the kitchen sink (and this includes core operating system functions), is the reason that it needs security updates.
Did the Dreamcast Web Browser need security updates? Does the built in browser on my cell phone need security updates? Nope, the sucker isn't capable of doing anything bad in the first place.
As for virii, that is easy, just remember you are making a console with the ability to do common computer tasks, but it is still a console. The sucker shouldn't be ABLE to execute anything other than the built in APPS and software in the disc format the console uses. Also, the file system should be designed in a manner that makes all system data completely invisible and unaccessable.
Lets imagine the console has 256 or 512 Ram (not out of line for next generation). Ok, got that part, good. Now the hard drive has two partitions, Fubu and BooBoo. Fubu is the only bootable partition, consists COMPLETELY of a memory image. The bootstrapper exists in ROM, we will call it Rubu.
Console boots, the bootstrapper Rubu loads loads the contents of the Fubu partition into memory. The Fubu partition contains a complete "booted" system image. With a few basic apps this should exist in under 64MB.
The Fubu image IS the system once it is loaded into memory, but it won't even be capable of reading the data format that it is contained in on it's partition. Matter of fact it won't even be able to see that partition, it won't even SUPPORT multiple partitions. It will only support the primary partition, while the Rubu bootstrapper can only load from the secondary partition.
The primary partition is the BooBoo partition, which consists completely of the user's own files, MY DOCUMENTS and such.
Did I lose anyone there? It isn't complicated to write a system that does what it is supposed to do and does not need updates. My proposed system would boot to a clean system each and every time, and it would have no way of breaking itself.
Also, build the Computer mode as a single monlithic application, OS and apps all rolled into one (like games are now). Then you would no more have to worry about people messing up the system than you would have to worry about people somehow making a virus run on your Galaga "operating system".