If something asks you about update/downloading/etc., reject it. You decide what to do and when, and you type the URL into the browser, or go to the normal menu/dialog/tool for updating.
(This is partly why Chrome browser is right and the normal approach is wrong: if/when it needs update, it just does it.)
I think you're really on to something here. A root problem of this is that a lot of legitimate software communicate via random popups out of the blue - training users to just "do what the computer says".
People are used to the computer being in charge and commanding them. This is bad from a UX point of view, but now I see it also affects security.
Yet another reason popups of all kinds should be forbidden.
When all application-initiated communication come from the OS notification area, this kind of dialog will make people wary. Which is a win.
If something asks you about update/downloading/etc., reject it. You decide what to do and when, and you type the URL into the browser, or go to the normal menu/dialog/tool for updating.
(This is partly why Chrome browser is right and the normal approach is wrong: if/when it needs update, it just does it.)