defender updates category
Defender Updates are released using a wrong category. They are tagged as "Definition updates" instead of Security (or whatever would fit in this place). The wrong category caused hundreds of machines installing the broken update 4052623.
Customers tend to deploy Updates of the category Definition updates directly to all machines using ADRs. So there is no testing upfront. Changing the category to something else would make ADRs ignore the engine updates and only deploy Definition updates.
Customers would be able to create a separate ADR for engine updates and have those being tested before deployment to all machines.