> Indeed, an update can't be more malicious than the permissions allow it to be.

...in the absence of sandbox escape bugs.