Completely agreed. Mainly, I wanted to make a distinction between "cannot be updated" and "can be updated but isn't". The former is a design choice that removes entire classes of vulnerabilities. The latter is a usage choice that keeps vulnerabilities open.