Same thing can happen on Mac (Catalina bricking MacBooks via bad EFI update) or Linux (where do I start).
Basically, you have to pick your poison and a sysadmin that withholds updates until all SW apps and packages are tested thoroughly on the company devices before green-lighting the rollout.
Clicking Update each time you get a notification, has the risk of ending badly for your business no matter what OS you choose.