> Your entire security depends on a random employee of a random organization you entrusted with this control to not get compromised, not compelled by the govern

> Your entire security depends on a random employee of a random organization you entrusted with this control to not get compromised, not compelled by the government, not made shady deals with other parties to ship a backdoor to you. As opposed to what? How do you test for all that with manual updates, as an individual or a small organization? Even for a huge organization which reviews most of the updates it installs, critical updates should be applied immediately, to avoid the lag.