It’s not that they just found out, but more that they have combed through and prepared all of the information they could legally release.

Exactly this. MECM even has this sort of feature built-in with Orchestration Groups. You can set group 1 to perform updates and reboot at a certain time, then group 2 will only begin its update/reboot cycle when group 1 has completed or crossed a certain threshold.