This is always an attack vector I've been concerned about. Software companies convince themselves that their security is unimpeachable, Microsoft enough so that they make their updates mandatory.