IMovie, GarageBand and iWork are not installed by default and you can remove them at any time.

Recent Mac OS updates are monolithic signed binaries that load into the protected disk partitions reserved for the OS. This is security feature to limit which processes can modify the OS. The downside is that it can’t do differential updates. I hope that, at some point, Apple will work out how to securely do differential updates and speed this up, but I’m satisfied with slower updates if it maintains security.