As the memorable quote goes, "Updates are like vaccinations that have a large chance of making you grow an extra 3 ears, lose one eye, and turn your skin bright green."

Updates to fix specific and very important bugs are good. Updates that do more are not. Unfortunately, I have often pondered how to solve this problem, and come to the conclusion that it's not easy --- but perhaps if almost all the users take a stand and just do not update whenever it's not for the specific and sole purpose of fixing some important bug, even if it means leaving security behind, maybe companies will finally listen and stop making security an excuse to bundle in other unwanted changes; because then they'll know that any attempts to do so will be met with high resistance, and if their goal was to secure, they would only fix these security issues and leave everything else alone.

Although it's not Apple, the sentiment around Windows Vista and 8.x show that companies do care about their customers to some extent; but they're not going to care if the majority of users just slavishly accept whatever they get.