Malicious updates and vendor malware are super hot topics now. Out and out vandalism of private property obviously breaches every flavour of "computer misuse" law.

There probably hasn't been a massive class-action against companies like HP because not enough users feel they have redress, or they believe that they "agreed" to malicious acts of vandalism. I doubt HP would find any contractual safety to hide behind here.

But the harm I see being done is bigger and more nebulous. It is a massive harm against security in general, and therefore against the public and nation.

As you say yourself, it's only sensible to see "updates" as very probably hostile. I would agree. There is debate in security circles about whether one should apply updates at all.

Yet, updates are a necessary component of modern security. Forcing malicious updates on users is therefore a "crime against the fabric of society" and I'd love to see a government make an example of HP, Microsoft, or anyone else pushing malicious "updates".