Ubuntu has a well defined update policy and process. It couldn't be farther from "randomly pulling installers... and installing them willy-nilly". It's document

Ubuntu has a well defined update policy and process. It couldn't be farther from "randomly pulling installers... and installing them willy-nilly". It's documented at https://wiki.ubuntu.com/StableReleaseUpdates https://wiki.ubuntu.com/StableReleaseUpdates Here is an excerpt describing what's eligible for an upgrade- "Stable release updates will, in general, only be issued in order to fix high-impact bugs. Examples of such bugs include: Bugs which may, under realistic circumstances, directly cause a security vulnerability. These are done by the security team and are documented at SecurityTeam/UpdateProcedures. Bugs which represent severe regressions from the previous release of Ubuntu. This includes packages which are totally unusable, like being uninstallable or crashing on startup. Bugs which may, under realistic circumstances, directly cause a loss of user data Bugs which do not fit under above categories, but (1) have an obviously safe patch and (2) affect an application rather than critical infrastructure packages (like X.org or the kernel)." If you don't trust the packages Ubuntu provides as updates, why do you trust the packages they initially provided with the release? I think that in most cases the updates are going through a more rigorous QA process than the initial packages.