> And if a fix for a critical vulnerability and an ad feature are both in the same update?
Can you point to actual real-world examples where this has been the case?
I don't see the point of this stretched hypothetical. If it were to come up, then you could deal with accordingly - for instance by getting the update and then blocking the ad server somewhere upstream in your network path.