Yes, program authors should just get it right the first time. If they hadn't written those bugs in the first place, there'd be no security exploits!

I understand that the updates are annoying, but all of the alternatives are worse. Silent updating? I want control. Manual updating? People won't do it. No updates at all? The botnet lords love this idea.

So the only real solution is to default systems to patch themselves, and hopefully get the experience right for the confirmation dialog.