This is an interesting and genuine case where I can see that it doesn't make sense.
In your case it should be possible to have a windows "branch" with just critical vulnerabilities patched with binary diffs or something rather than 680-odd Mb patch sets.
That's the obvious general solution for everyone - having critical security vulnerabilities on their own channel, without being required to take the features/antifeatures too.
In your case it should be possible to have a windows "branch" with just critical vulnerabilities patched with binary diffs or something rather than 680-odd Mb patch sets.