If the base of their site was served from an auto updated base, there's no reason why it couldn't be pretty much as secure as a platform.
Say it's a frontend over a Docker image that gets updated upstream for security issues, and the server has a Cron job that keeps it up to date.
Why couldn't that work?
I know there's some centralisation around the Docker image, but that could be open source or provided by someone like Mozilla or Apache or WordPress who we can trust.
And there's no reason why the user couldn't choose from a whole ecosystem of image providers with a simple enough UI
> After more than 125 years of using two-dimensional paper drawings, the shipyard has set its sights on a “drawingless” future, where work instructions are packaged and delivered electronically.
> The migration is already bearing fruit. To date, 14 work packages on Kennedy have been completed using “visual work instructions” provided on hand-held tablets.