I don't see the security angle either. You could design the system in a way that makes it able to force updates into the individual user's broken packages. Heck, it shouldn't even be connected to a user - it's just that every user should be able to install a package, and what install might mean is

  * compartmentalized side-effects (not per-user even -
    users might decide they want multiple compartments for 
    different apps) and 

  * a shared storage area for all the packages and their
    versions (i.e. Nix)