This should really have been a separate fix & installed without user interaction. Instead this is 450 Megs & requires a restart. It'll take days for it to get out to those at risk.
Considering it needs to update the TLS support on the rescue partition too, doing it outside of single-user mode is probably not a good idea.
You're nitpicking, it seems.