Silent auto-update would also be normally classified as a deliberate RCE vulnerability or a backdoor, but for some reason most people are okay with that.