There's updatable software that only updates when you tell it, and only to the version you tell it to, but it's certainly not the norm.

Let's change that. Anything less is a RCE vulnerability.