> The negligence it in the design of the system.
Not sure. It seems like a fairly generic update approach. eg a central server(s) provides available updates, with client software on the PC checking for them.
As a concept, that's what MS and Apple's update approaches (for consumers) do too.
It's just ASUS are extremely incompetent with anything software related, not just security.
Hopefully this, plus the previous fine for their incompetence, gets their leadership to change things in a positive way.