I appreciate its not ideal, but its a relatively easy way to improve things. Not sure of another good way for tracking, downloading and installing mainline component security updates.
Having Play Store only in a secondary user, and uninstalled for the main user, means that it can’t run until you start the secondary user. Which is a bonus