That is the dream isn't it? But there's no such thing since even a simple one that requires no updates would have some sort of vulnerability that needs an update, and the cycle continues.

I agree. But we could still try to have a smaller hardware initialisation system. And if there is the occasional need to patch a security vulnerability, then that patch is probably a lot more straightforward.