I've not had any issues with CPanel. The question here is more of what Hosting providers are allowing.

The customer is paying for a service. The customer may not own the service but does own the website. What gives the Host Firm the authority to have software they are utilizing modify what is not theirs to modify.

The customer need IMHO simply call the host firm, ask for someone in management. Explain the matter accordingly. If management states "That is our policy" you say, "Ok. So your policy is for your company to modify other peoples web interests without any prior notification or approval?"

"There are myriads of hosting firms out there, I am sure this will go well with Hosting Review forums, tech sites I attend as well as our State Attorney General and Visa, Mastercard, Amex and Discover.

Wait for the silence.

You will probably hear, "Well its Plesk CPanel doing this". So respond with, "So? Your telling me you allow a third party software company external of your hosting firm blatantly modify applications hosted by your company? In fact, modify the software preventing or interfering with updates procedures that deal with everything from security to application updates?. I guess perhaps I was wrong. I may need to contact your State Attorney General and congressional representatives and show they need investigate this matter deeper and perhaps seek injunction. How many Wordpress websites are hosted with your company? How many of them may be compromised due to this decision by your company to block critical updates?"

"Maam' its not us, its Cpanel".

"My site(s) are not hosted at Cpanel. I pay your firm for a service, no more, no less. I presume that your company takes that service seriously. I presume that your service in hosting Internet web sites and services is completely aware of how imperative security and keeping software up to date is? Apparently some other influence is occurring for your firm to allow a third party software package that administrates web space and hosting features to not only interfere with websites but also modify the applications directly. Whats next? Plesk stealing peoples credit card information?"

"This clearly warrants investigation by proper entities. Perhaps as well the Wordpress community needs to set up a website of hosts approved that will not block features, remove the capabilities of updates thus keeping their blog sites, ECOMMERCE sites and all forms of Wordpress websites secure. This way, your firm and those like it wont need to worry about Wordpress security since the well connected Wordpress community can simply utilize web hosting firms that have that community and users best interests at hand."

"I will be encouraging all webmasters we are in contact with to do just as I have outlined beginning with their State Attorney Generals and Congressional representatives. This may effect countless hundreds of millions of peoples personal security and certainly many millions of websites."

"We will apparently all need seek hosting firms that do not allow third party software developers to set down policy or blatantly modify what amounts to personal property or business property without any notice, warning, correspondence or permission from those owners to do so. Then it will need be explained to Visa/Mastercard, American Express and other financial entities since they too have interests at stake. That of their clients who are billed for services as well as those users on the Internet whom may have identity matters exposed due to firms such as yours blocking what can amount to critical security updates. I am also certain some attorneys will see this as an opportunity seek damages. Perhaps some legislators as well as to why they need tighten the reigns on what hosting firms are allowed and disallowed to do and ultimately whats best for the public interest"

Done.