Updates themselves are a security risk, because they're a first-party malware vector. Pick your poison.