Or someone can just turn off updates and never download the patch.

It's a meta product. Safe to assume that sooner or later it will be unusable unless you install the latest update so it can continue phoning home.