He had enabled a setting that says "Install [...] security updates". If enabling that setting does not lead to the system installing security updates, that's on Apple.

System updates also include security fixes.

Which is not apparent if you give them an explicitly labelled separate toggle.

I guess Apple could do what Microsoft did and take away the user's ability to control system updates.

However, this user made the choice to turn off the installation of system updates manually, based on a false assumption.

This user turned off the installation of system updates, because Apple labelled a control incorrectly.