Maybe they can be fully updated remotely. But let's think about this...is that really such a good idea? Can we trust subway card machine software to be fully secure against malware and remote exploits?

Maybe it's better if the network interactions of these sorts of machines are strictly limited to operational transactions. Maybe it's better if it does takes a human being with a key, guarded by a cop with a gun, to update this software.