It is highly irritating to see that the "patch" to fix one unchecked buffer copy turns out to require half a dozen whole-file-replacements and takes tens of MB, when ultimately only a handful of bytes needs to be changed. Perhaps these companies should learn from the crackers and reverse-engineers and make patches that are actually patches: find and modify the appropriate bytes in memory, and also the file on disk. Those who have used crack/noCD/etc. patchers will know how fast and painless the experience is. The changes are instant and persistent, with no disruption at all.
If such a system was used, I would guess that security updates may, instead of the hundreds of MB or even GB they take today, and take tens of minutes or more to install (not even counting the productivity lost by the obligatory reboots), only be MB at most --- with the majority being several KB, install instantly, and present absolutely no disruption.
To play devil's advocate, the system provides great APIs for preserving work during reboots (above and beyond just saving to files, full state restoration of all UI in the system frameworks). It's arguably only poorly designed software that does not do this.
I don't fully believe this, but it's one way of looking at it. For pro users, shouldn't be rebooting, for most users, they shouldn't notice.