That is true but the risk of backdoored updates by state actors is a reasonable price to pay for security fixes to avoid every device being a node on a script k

That is true but the risk of backdoored updates by state actors is a reasonable price to pay for security fixes to avoid every device being a node on a script kiddie enormous bothnet, or a WiFi ingress point, IMO. If the software is broken and not updated, a state actor can hack it anyway.