While you can certainly bribe, coerce or trick an upstream maintainer to accept a malicious patch, there's still a whole network of downstream maintainers that

While you can certainly bribe, coerce or trick an upstream maintainer to accept a malicious patch, there's still a whole network of downstream maintainers that all want to have their say, and there's usually ample time for the community to form their own opinions about what's going on, even if that sometimes leads to a lot of silly polemics. I don't know of any free operating system that forces updates, and even if Apple doesn't they still have excellent means to coerce users to accept those updates by withholding all their centralized services. Which is precisely what Sony already did with the PlayStation 3 update in 2010. This is where the Affero GPL comes in. If the users of one service find the terms and conditions to be onerous, they can simply launch a replacement service using the same software on the same day, preferably without breaking a sweat.