Just like it’s ridiculous to let installers run as root without a sandbox, it should be considered ridiculous that we can’t constrain updaters: I should be able to say “bug fixes only” or whatever, and see only that happen. Instead, it’s UI-of-the-week.
A straightforward way to ensure this would be to have substantial limits on size. It is pretty hard to redo an entire UI if you’re restricted to a 100K update, for example. And it would help to prevent data plans from being sucked up by careless app vendors.