A good idea to do in parallel or as an alternative is automatic update of patterns of request to block. This means no code has to be automatically updated (i.e. lower risk), but the pattern can be blocked. The user can then upgrade in their own time.

Implemented the simpler idea - auto-updated software firewall - for v10. This is much better that the complex idea as it cannot be abused as an actual attack vector, and has far less scope to go wrong.