Characterizing an auto-update system as a RCE for the product's developers is an absurd exaggeration IMO. Most of the security world seems to consider automatic

Characterizing an auto-update system as a RCE for the product's developers is an absurd exaggeration IMO. Most of the security world seems to consider automatic updates to be a good thing so that actual vulnerabilities get fixed rapidly across the whole install base. What is the recommended resolution here anyways? An alert for the updates that the user can refuse? I think real-world data suggests that, if there actually was a backdoored update, that would be a terrible way of dealing with it.