Regarding Update/UAC Please blame microsoft.

I don't want forced updates when I am working. And many time I have encountered issues like computer not booting. After updates they prompts "Please install our cool new software called edge".

I want security update not the marketing update. So I make a compromise and disable update all together. Why not give linux style update where I can review each and every package.

Linux Distros are just bundles of software that make up the operating system.

So if your compromise is that you don't want new Windows 10 updates because they also bundle in new features rather than using an OS like linux, then it'd be your fault if you get hacked via an exploit that was patched in an update.

Microsoft aren't going to care.

Then the obvious solution is to make them care. We penalise corporations for financial negligence and failing to take proper precautions and report correctly. We increasingly penalise them for violations of privacy and data protection rules, where similarly they are expected and required to provide adequate infrastructure to comply with the regulatory obligations. If failing to implement reasonable security practices and provide appropriate security updates to users with no strings attached started costing the hardware manufacturers and software developers and resellers the same kinds of penalty per violation as some of the financial or privacy regulations, we'd soon see those security updates universally available without forcing all the unwanted user-hostile changes at the same time.

What if they rewrote a component to have new features and it also fixed a security issue?

What's the difference between a security patch and a bug fix?

At the end of the day if someone gets so angry that Microsoft added Paint 3D in an update that they disabled updates.

What's the obligation here? They chose not to update their computer.

I'm suggesting that perhaps there should be.

In what other area of consumer protection law does a manufacturer or reseller get to provide a seriously defective product and then refuse to deal with the problem unless the buyer also accepts other changes that might make the product significantly different and possibly in their view significantly worse than the one they chose to buy?

The principle is important here. Your example about Paint 3D is cute, but in reality, there are plenty of other examples where user-hostile software changes have been pushed out after purchase, including those that disabled previously available functionality, reduced privacy, introduced advertising, or dramatically changed the look and feel of the product. People shouldn't be forced to accept these kinds of unwanted retrospective changes to the product they originally chose to buy just to maintain an adequate level of security.

For the record I hate this, but history has shown that if you don't try your absolute hardest to get security updates installed onto users' machines, they're going to constantly get owned by malicious third parties. Chrome and Firefox aggressively auto-update for the same reason (if you try to manually install old Chrome for testing it'll obliterate itself on next launch!) The vast majority of users simply do not pay attention to security and will not make the right decisions if you offer them choices about updates and security, because they don't have enough knowledge or context to make the right choices.

W10 education and enterprise licenses allows you to manage the updates yourself.