They were wrong in the sense that they used it to condition people to accept non-security updates and they were wrong in the sense that some people are better placed to determine whether any form of update is an unacceptable risk.

As things stand today, I only trust updates from community driven open source software projects. With exceptionally few exceptions, commercial software seems to offer the guarantee of delivering undesirable payloads.

I work for one of those very large commercial software companies. In general, I think we do a pretty good job. We absolutely fuck some things up, for sure, for a lot of different reasons.

But I promise you there is never any kind of Machiavellian multi-year plan to condition people for upcoming bad behavior. Most of the things we do screw up are from lack of foresight; we are definitely not strong enough at long range planning to run psyops on customers.