For a long while now it's been worse than that. Security updates are an excuse to push out new unwanted features (remote flags) or remove existing features in the process of being monetized.