If they’re allowed to force updates then they should be legally required to separate feature updates from security patches. Only security patches should be forced.

Feature updates that change or remove features users depend on should never be forced.