Exactly, now when you're writing contract that calls upgradable contract, you need to consider that its implementation may turn into hostile code. And it goes deeper - you can call normal contract but if that contract is calling upgradable contract - you may have the same problem (that's harder to track).
IMHO it violates basic guarantees of the blockchain that things underneath you won't change. The focus should be on designing correct contracts upfront, patterns, automatic provers etc. not "solving" the problem by allowing for arbitrary change.
Also "upgradable contracts" sounds nice but it's extremely difficult to actually upgrade more complex contracts, you can't just modify things the way you feel, the original storage can't be changed, this means you can't introduce/change/remove fields in existing structs etc.
IMHO it violates basic guarantees of the blockchain that things underneath you won't change. The focus should be on designing correct contracts upfront, patterns, automatic provers etc. not "solving" the problem by allowing for arbitrary change.
Also "upgradable contracts" sounds nice but it's extremely difficult to actually upgrade more complex contracts, you can't just modify things the way you feel, the original storage can't be changed, this means you can't introduce/change/remove fields in existing structs etc.