We're getting into the debate of what constitutes a "core system", and I'm afraid there's as many answers to this question as there are debaters. As far as the

We're getting into the debate of what constitutes a "core system", and I'm afraid there's as many answers to this question as there are debaters. As far as the update routines are concerned - you can already have those, by self-selecting which packages do you want to update. As a pro-active measure, you can even lock down packages which should never be updated. This seems to be fine to me - the advanced user has the means to control the update mechanism, and the casual user can just do an all-encompassing "apt-get upgrade" or an equivalent to make sure that she has all the security fixes.