Didn't see that, but...

Now if someone successfully publishes a hack that steals everyone's data and/or creates a botnet everywhere it's installed, there's no way to actually pull it down and override it.

Unless there's a centralized authority with the ability to do that, in which case it's not decentralized and we're just changing who controls it.