"At least with Windows you can block undesirable updates by pulling the network cable out. On a Chromebook, you can't even do that."
Yeah, you can. You can control which updates are applied and are not applied from the Chrome management console in an enterprise set up. It is pretty awesome. You can set it up where devices are shipped to users wherever they might be directly from the OEM or VAR and when the devices hit the internet the policies are pulled down and the device is automatically enrolled at log on.