How would one know that this black box works the same for every user? What would stop Apple from distributing a compromised update to everyone or to selected users?
With closed source software, though, this doesn't give as much confidence, since a company could create a version which they send to everyone but which contains an "if (userId == NSA_TARGET)" conditional branch.