"That said... a reasonable expectation may not translate into something actionable in a court of law."

IANAL - but UK law explicitly implemented rules to govern consumer agreements where you can't negotiate contract terms. (Unfair terms in consumer contracts regulations) which were based on an EU directive from 1993, which effectively boils down to a reasonableness test (although there are restrictions on fields of reasonableness).

Whilst I don't have a problem boycotting Sony, perhaps such contracts probably needs some sort of proper legal redress in the style of the European directive, as otherwise it would be pretty much impossible to buy/lease any modern software or hardware without agreeing to similarly outrages terms and conditions as were used in this class action.

Apple get called draconian because of the things they do.

Being a good citizen in free software doesn't just mean doing those things in your own self interest to do, of which we agree Apple do a lot, but also not doing things that might be perceived as in your own short term self interest that are unethical (of which Apple also do plenty).

I don't think registering a URL to an XML file does the trick.

The Linux distro's typically sign the packages, saying they were presented to the distro by someone they trust.

You need some sort of security in place, otherwise the system is effectively trusting all the web servers in all the URLs, and we know how safe web servers are.

But yes if Microsoft update updated everything, then people would have motivation for running it. Where as if it just updates a few system and Office - things that no one cares about till there PC is spamming - where is the motivation?

But it boils down to the same thing, trusting a single central authority, and since Windows users implicitly trust Microsoft, it might as well be them.