You'll still get dinged in security audits for it if your auditor feels lazy and needs some gotcha to prove his worth to management. I've been trying to argue

You'll still get dinged in security audits for it if your auditor feels lazy and needs some gotcha to prove his worth to management. I've been trying to argue against it, but in the end management would rather waste money on completely pointless bootstrap updates than change their policies. Oh well, not my money…