'Managed means they patch my plugins' — almost never true

'Managed means they patch my plugins' — almost never true
Heard this week: a breached agency assumed plugin updates were 'managed.' Word is managed covers the stack — OS, PHP, web server, sometimes core — and stops at the application layer. A source running platform security at a WP host tells us touching customer plugins is a liability they explicitly disclaim, because an auto-update breaking a checkout is on them. The advice to 'let them handle security' confuses infrastructure hardening with application maintenance. Those are different teams, different contracts.
Watch this: hosts now selling 'managed plugin updates' as a paid add-on are drawing the line in public.