It is possible that their implementation of settings simply sucks, not checking the off-switch everywhere it should. This is one reason I don’t trust Facebook’

It is possible that their implementation of settings simply sucks, not checking the off-switch everywhere it should. This is one reason I don’t trust Facebook’s huge list of “settings” either, for instance. In complex systems there are just too many ways that a switch can be ignored, even if you do trust the intentions of the developer. A better solution for this (and Facebook) is to physically block at the client. And rather than providing “settings”, Microsoft should proactively encourage this too: the official FAQ for disabling updates should essentially be specifying the domains and IPs to block in routers for example.