FWIW, I would support a core patch that adds a permission to "Run updates".

And here it is: http://drupal.org/node/67234
 
Nat