By all means make the default behaviour apply security updates, but that is very different to forcing updates of all types no matter what. In any case, for use

By all means make the default behaviour apply security updates, but that is very different to forcing updates of all types no matter what. In any case, for users who do have some idea of what they're doing, OS security updates are probably a relatively low priority today. Frequent robust backups, proper firewalls, and applying security updates to any applications that pull content from remote sources are likely to be more important in practice. If you get to the point where you're relying on your OS to protect you, you've probably already gone wrong at least once. Most desktop OSes won't do much to protect you against threats like data exfiltration anyway, because the security models are nowhere near sophisticated enough.