[majewsky]

Yes, but if statically linked, this excludes all software that relies on security-relevant libraries (e.g. cryptography) or receives data from the network. I struggle to think of a lot of software that would qualify beyond coreutils and friends.

[the_gipsy]

The interesting case here is dynamically linked software that doesn't need updates.