Even if in this case the changes they make are damaging the system security, the trademark policy doesn't say anything about security or updates: you just can't

Even if in this case the changes they make are damaging the system security, the trademark policy doesn't say anything about security or updates: you just can't ship unapproved changes in an image called "Ubuntu", regardless if those changes are secure or not. Edit: typo