[roca]

Why does "Updater" "not really count" as "remote code execution privileges"?

Either the vendor can remotely change your software and its configuration without user intervention, or it cannot. For any software that supports unattended updates, it can. End of story.