In reply to PP.

Hi @otto, You have a point there.
I have mis-phrased a little in my reply to PP. What I meant, if the site has been set up/configured to only get the minor security updates but not the major updates (frankly a standard installation) that person does not expect major updates to happen on his/her website.

Please keep in mind that there are a lot of WordPress users who haven’t set up their websites by themselves but hired a freelancer or agency to do so. Expectations are often set by them. Not all developers honor WordPress standards and in here lies a problem (how sad this may be, it’s in their right).

WordPress provided the software package as is (without warranty). The build installation / configuration and communication is done by the hired developer. The communication where: setup criteria are being set(briefing), instructions are given and expectations are being discussed. Also there might be a legal document to be signed off where updates amongst other things are explained.

A legal difference is partly applied by law (in my case EU law) and partly within the GPL (make it into whatever you want). For security updates you do not need an explicit consent (in draft as Heather pointed out) but major updates are legally different .

Let me reiterate that I do get the sentiment behind the idea, but like many others already pointed out, the proposed approach is not the way to do it.