+1 With so much of tooling and products, it should come down to - What am I running and their current security state - Supply chain of any change that's happ

+1 With so much of tooling and products, it should come down to - What am I running and their current security state - Supply chain of any change that's happening - Test/Stage/Rollout any change - do not trust the vendor, as they do not know your infrastructure By allowing OTA update, they assumed that the vendor has tested all permutations.