You left out that they refuse to let end users control updates on the system unless they resort to hacky bullshit (and even that doesn’t work consistently). As far as I know (and have experienced on Windows Server) this extends to enterprise as well.