I don't think security is something automatic, but I'm open to other opinions about this. If a firm is not willing to update my device anymore, why does an "au

I don't think security is something automatic, but I'm open to other opinions about this. If a firm is not willing to update my device anymore, why does an "automatically updated base" make me more safe? Without updates to the upper layers of the software stack I'm still vulnerable.. Is there a real advantage over Yocto plus un update mechanism such as rauc [https://github.com/rauc/rauc https://github.com/rauc/rauc] or mender [https://github.com/mendersoftware/mender https://github.com/mendersoftware/mender] ?