It shouldn't be that way though. Especially the billion dollar corporations should not be excused for shipping insecure software - the sad reality though is that Microsoft seems to have lost most of its QA team and what remains of its dev team gets shifted to developing adware for that sweet sweet "recurring revenue" nectar. Apple doesn't have that problem at least, but their management also has massive problems, prioritizing shiny new gadgets over fixing the tons of bugs people have.
Or if they were properly done. Example: Intel and the plundervolt vulnerability. To fix that they removed the ability for undervolting in ny laptop. If I don't use SGX there's no reason for the block. They could've restricted undervolting only when SGX is enabled but no, they had to "fix" it in the worst way possible.
Anyway, security updates should be decoupled from feature updates, so that people aren't hesitant to update. Otherwise, you get people who hold out because they're worried the new release is going to break all their settings and "opt-in" into all kinds of new telemetry.
This does not seems to be the case. Rounding buttons and changing icons size in Teams and Office 365 has nothing to do with security.