I think something like this was mentioned in 2600 once, where you can examine the list of changes and the code before accepting the updates, as well as to install only some changes instead of all of them. It seem good idea but may be impractical.

I have disabled automatic updates on my computer and instead manually select updates.