> There's multiple services dedicated to monitoring / "repairing" windows update, scheduled tasks to enable those, and further tasks to repair everything completely if anything is modified.

Sounds like we'd need some resident anti-virus-like software dedicated to enforcing the user's choices on the OS.

(but definitely do your updates so as to not become part of a botnet. Too bad the security updates must come with unneeded feature updates)