I think it's easy enough to imagine implementations that allow the addition of software vendors to the package system that permits regular updates. Many of the Linux package managers (e.g., Apt, Portage) permit this; for example, on Gentoo, I install Steam by adding Valve (/Steam) as a place that the package manager can obtain packages from.
That's not to say Apt/Portage are by any means perfect; the nature of how they are configured is definitely not going to be friendly to your typical Windows user. But I think it is possible to wrap that in a UI that adequately expresses "okay, you're adding the ability to install software from this vendor, and [the package manager] will help keep it patched & up-to-date."
I think we also need to combine that with better security models, so that desktop software isn't necessarily granted access to everything by default.
But UI design trends have spent the last decade "simplifying" UIs down so much that they fail to solve the problem at hand.
That's not to say Apt/Portage are by any means perfect; the nature of how they are configured is definitely not going to be friendly to your typical Windows user. But I think it is possible to wrap that in a UI that adequately expresses "okay, you're adding the ability to install software from this vendor, and [the package manager] will help keep it patched & up-to-date."
I think we also need to combine that with better security models, so that desktop software isn't necessarily granted access to everything by default.
But UI design trends have spent the last decade "simplifying" UIs down so much that they fail to solve the problem at hand.