IDC as long as they are not bending their knees to European countries that the EU hasn't yet kicked out. But mainly I don't care because I'm not American.
Auto update only critical and likely attack vectors (the kernel, network stack) and have them applied when shutting down, have visual hints that explain to them what each thing is and make it immutable.
Microsoft's implementation has a backdoor in it.