Presumably the user would get a prompt telling them they need to log out and log back in to pick up security updates, with a "details" button that shows them wh

Presumably the user would get a prompt telling them they need to log out and log back in to pick up security updates, with a "details" button that shows them which applications actually need to be restarted if they don't log out/log back in. It's certainly simpler for the developer to pick up the updates only upon rest, but it's sometimes very inconvenient for the user, and probably slower to pick up the actual updates. For instance, I run a vanity domain from a Linux device at home. It would be inconvenient to run Windows on that machine and have to restart it following monthly patches or following emergency patches.