UX failure in Apple's security update process

Question

It would have been much better if I could download the 700+ MB download in the background while continuing to work and THEN pull the trigger on applying the patch. There are no real reasons to couple the download phase with the patch applying phase - so does anyone know why Apple does so?

In this particular case, I had to delay the entire process till I was done with work and THEN attempt the "download+apply indivisible step". This actually widens the window till I'm vulnerable, so that's no good either.

Either Apple's engineering and UX team is being lazy at the user's expense, or I'm missing something else here.

Details: I say "no real reason" because a patch (security or not) is trusted due to it's cryptographic signature - not because of the timing of it's arrival on my hard disk. So whether the patch is executed fresh off a network socket or off my hard drive, a signature verification is done before executing i.e. signed code establishes trust.

Answer 1

Ok, so it's confirmed that this is a UX issue. I went ahead and began the installation but it appears users DO have some control over when to restart. This reality is only presented after the user commits to a restart (see image in question). The UX is introducing a false dependency in the user's head that doesn't really exist.

Figure: "The initial message was just a bluff!"

Answer 2

As annoying as it may be, there may be a reason, we don't know what the patch does or how it does it. Apple is an extremely bad company for some things, but it is as good for others, and usually, users are high on their level of interest.

Some times an update requires a multi-step process, and so, it needs to restart, install or set part of the upgrade, and then, depending on the outcome, download some other elements. All the upgrades don't work the same way, some are just a simple piece of code that can be downloaded and installed without user noticing, some are more complex and adapt to what the system has.