[jdmichal]

> For something so critical, there should simply be too many safeguards for any test to make it through all the way to end users.

The only way to guarantee that is to not allow updates to be published at all.

> If a test could get through without being discovered, then so might malicious code.

You are conflating very different things. MSFT being able to publish updates is normal and does not require a security breach, even if one particular update shouldn't have been published. An external entity being able to publish an update containing malicious code would be a huge security breach, requiring both the ability to sign the update and to publish it.