You can find vulnerabilities using a variety of techniques, but to properly patch them you do need access to the source code. These "updates" don't even modify the executables, so would have to be applied every time you turned on your P.C.

Wrong. Look at the other comment I made here about Ilfak Guilfanov.

They have the ability to sign files with Microsoft certs?

urr durr just programm in assembly