It seems like the idea is if you want to disable it for yourself, go ahead. Don't disable them for someone who isn't a technical person. IMO They should introduce a way to auto-approve only security updates, like its possible with WSUS. Maybe a cloud based WSUS for consumers?