Agreed. This is the main distinction. If they are explicitly charging for security updates and being upfront that would be a completely different story. That being said, if they could do that then they can also charge for security updates piece-meal.