[ssivark]

What stops OEMs from publishing dummy updates that satisfy the legal checkboxes?

[Dylan16807]

Dummy updates aren't security updates, so they can't satisfy the checkboxes.

If you're asking how it gets enforced, there could be a government office tasked with enforcement, and the law could let people sue.

[LtdJorge]

Then leave one security patch out of the update and push it to the next one.

[Dylan16807]

So put in the full work to patch things, but do it slightly wrong on purpose? What do companies gain by being so passive-aggressive?

[ssivark]

Higher revenues through induced obsolescence?

[Dylan16807]

Delaying patches slightly doesn't really help revenues unless it's widely publicized, in which case they look bad and possibly get sued and it doesn't even save them any effort. Maybe it's a risk, but I'll definitely take that risk over what we have today.