We had a similar conversation about per user installs for Teams.
As to “can it be patched”? It depends on what the vendor provides for patching mechanism. For patches where the user must be logged in, you could use the Take Action Dialog feature to require that user’s presence when the action runs. If you need to impersonate, check out the Override feature in Action Script.