Even if you could force every app development company on the planet to support two-channel updates for "security only" and "everything else", How long would it take for them to force non-security related updates into the security channel through some vague justifications?