Principle of least privilege trivially prevents updating system packages. Like if you don't want people using apt, don't give people root on your servers?