Quite obligatory XKCD: https://xkcd.com/927/
I'm writing software updater right now. Security is one of major concerns. Target platform, both client and server side is Linux. I write most of the code in Python. Looks like great opportunity to use TUF. But it is not. My updater has so many specific requirements that TUF is not nearly what I need. More than this, TUF is not subset of what I need and cannot be foundation for what I need, even from security perspective.
Initially client knows only own hardware ID (which is just sha256 of part serials, MAC, etc.), and registers itself on server, which is allowed only from trusted networks. During registration client receives unique HTTP client certificate. Later administrator approves registration and assigns client specific stream. Stream may include sensitive information, like unique credentials to access some other services. Some overlays, which are not secret, like executables, 3rd party libraries, OSS stuff, are just rsynced to save time and bandwidth, but others like configuration and credentials, are downloaded over HTTP with client certificate authentication. Overlays are merged on client side in memory and applied in semi-atomic way (series of file moves within partition, not writes or other I/O in between).
There are a few other requirements, like log if devices tries to register second time, log if device tries to register from non-trusted network, log every update attempt, successful or failed, etc. And this is of course just brief overview. For instance, administrator approving registration is not a single person, but group of administrators, each with different permissions on streams. Client cannot download stream of some other client, and cannot get any information on overlays used by other clients, etc.
I do not see any way generic updater [framework] (not only TUF) to fulfill my requirements not causing more problem, than solved.
A couple things you pointed out are definitely hard with TUF right now:
> For instance, administrator approving registration is not a single person, but group of administrators, each with different permissions on streams
TUF is being actively developed and this type of approval pattern is planned: https://github.com/theupdateframework/tuf/issues/346
> Client cannot download stream of some other client, and cannot get any information on overlays used by other clients, etc.
This is currently a limitation of TUF, but it is known and there are some tentative plans to address it. If you have specific use cases you'd like to contribute to the discussion, there are GitHub issues and the mailing list.
I think it's worth pointing out that even if you don't use TUF, you need to be thinking about the vulnerabilities it's designed to protect against. Once you start doing that you'll probably end up with something similar modulo formats and transport.
"Those threats" in this case are things which major package managers you rely on currently get dangerously wrong. (I'd rather leave this sans naming of names and as a "think critically" thing, but seriously: for one example, look at apt and how it handles rollback prevention.)
TUF is not a pointless competing new standard. It contains useful information and constructive thoughts. If you think the 15-standards XKCD is a relevant dismissal... try giving it another read in the morning.
(I'm sorry, but this XKCD really raises my hackles when used wantonly. I've never seen such a good description of threats to update systems as the TUF spec. I link to it constantly as an educational material. It's really not constructive to dismiss it with a webcomic link.)