It is possible, with caveats. The user has to be able to decide whether to accept an update or not, and signal their assent or rejection with their password. An

It is possible, with caveats. The user has to be able to decide whether to accept an update or not, and signal their assent or rejection with their password. And the software has to be open source, so that the user can inspect a proposed software update and decide whether it is malware or not (or let others inspect it and know they have the same thing). In practice this is imperfect, because trustworthy volunteers willing to audit software are scarce.