They don't actually have to be in the same update, the security fix just has to come after the ad antifeature with no separate patches presented, only a linear series of versions. And that linear model is extremely common. Anything using the linear model that has both antifeature updates and security updates at unpredictable times is very likely to run into the “can't install the security update without accepting the antifeature” problem.