It would have been much better if I could download the 700+ MB download in the background while continuing to work and THEN pull the trigger on applying the patch. There are no real reasons to couple the download phase with the patch applying phase - so does anyone know why Apple does so?
In this particular case, I had to delay the entire process till I was done with work and THEN attempt the "download+apply indivisible step". This actually widens the window till I'm vulnerable, so that's no good either.
Either Apple's engineering and UX team is being lazy at the user's expense, or I'm missing something else here.
Details: I say "no real reason" because a patch (security or not) is trusted due to it's cryptographic signature - not because of the timing of it's arrival on my hard disk. So whether the patch is executed fresh off a network socket or off my hard drive, a signature verification is done before executing i.e. signed code establishes trust.