Even if there was a canary release process for code updates, the config updates seem to have been on a separate channel. The expectation being that people want

Even if there was a canary release process for code updates, the config updates seem to have been on a separate channel. The expectation being that people want up-to-date virus detection rules constantly even if they don't want potentially breaking changes. The missed edge case being an untested config that breaks existing code. Source: Pure speculation, don't quote this in news articles.