What updates? That would be on a local network and have no internet connection, if done right.

I am guessing the main attraction of such a system is that owners can set the cards remotely and get data about it (ie: who accessed and when)

And? That doesn't mean, especially for a system with security impact (like door access), that it should never be updated.