Re 1, yes it’s sensible as law, but I imagine Big Tech freaking out at the possibility of having to maintain some security-only update branch for every version a user might have started with.