> Coming from predominantly the Windows world, I never expected a Linux machine to silently go so far into being Microsoft.This is a common mistake: you are conflating Linux and Debian. You don't have a Linux operating system, you have a Debian operating system and services & applications package (a "distribution") that happens to use the Linux kernel and other common parts associated (though in many cases not exclusively) with the Linux ecosystem.
MS wouldn't touch MySQL in an update because they never provided it for you. They might break it with changes that the upgrade makes and it isn't their responsibility not to (if you kept MySQL updated then you'd be fine as the maintainers would be aware of breaking changes in the OS and would have released updates to handle them ahead of time - but the onus here is on you to monitor that situation). They wouldn't change the operation of the DBMS they provide with the OS because there is no DBMS provided with the OS for them to break. A fairer comparison is MS updating IE with Windows upgrades, potentially breaking maintained web sites/apps that depend on non-standard and/or undefined behaviours in older versions of IE. Windows releases do often break other software, as do SQL Server release upgrades, as any major update of that sort does which is why thorough testing before releasing to production or otherwise mission-critical environments is essential.
> Installing software that was not authorized on someone's machine is a serious security compromise.
The release notes quite clearly state that it is going to happen. By installing the release you effectively authorised the process. And "serious security compromise" is hyperbole here IMO. A functionality compromise, yes, so effectively a DoS, but only for software more manually installed that is therefore not Debian's responsibility to keep compatibility with at all, and by installing the update without understanding it when the documentation was there to read you DoSed yourself.
While we are throwing around hyperbolic statements of blame: Not understanding the nature of the release update by at least reading through the release notes, and not testing an update in a pre-production environment, are both serious due diligence failures.
If the upgrade had left a (now unmaintained) mySQL install in-place with warnings in the documentation someone who didn't read that documentation wouldn't have seen the warnings any more than they would see the notes about the switch from mysql to mariadb so would have been left with a potentially insecure environment down the line as flaws are found by remain unpatched as Debian don't support mysql packages in that release.
If they had simply dropped the package your system would have been completely broken without manual intervention to install mariadb in its stead leaving your environment (more) broken.
The only way to keep everyone happy would be to keep maintaining both sets of packages, which, lo and behold, for all intents & purposes they do trough the LTS program: current old-stable is effectively supported until April 2020 so if you must keep mysql for compatibility purposes with software not provided as part of the distribution then you can keep using that for a while yet giving you nearly two more years to find a solution (waiting for that software made compatible with mariadb, finding an alternative to it, using mysql from another source (compiled locally or through a third party package repo, or moving to a Linux-based OS that does maintain mysql packages).