A major downside to doing a software update is the loss of brower state. Now that we have the Session Restore service, it's not necessary to do so. Setting the browser.sessionstore.resume_session_once preference to 'true' for a Software Update should cause the browser to restore its state after the software update is installed, making the update process much more palatable. A UI might be desirable to bypass this for a small subset of users, but one can assume the vast majority of users aren't looking to lose their state to accept a security update, so a default of true should be acceptable until a UI is available (and about:config is available for the users who want to lose their state for upgrades). This should also speed adoption of security updates, so it's good for mozilla's reputation.
*** This bug has been marked as a duplicate of 311744 ***