> also drops by virtue of less eyeballs

I don't think the people automatically updating and getting hit with the supply chain attack are also scanning the code, I don't think this will impact them much.

If instead, updates are explicitly put on cooldowns, with the option of manually updating sooner, then there would be more eyeballs, not fewer, as people are more likely to investigate patch notes, etc., possibly even test in isolation...