They might be able to, but, if they are effectively saying "our product is broken and you can't use it until you do X" they could be responsible for massive contractual liabilities.
Based on aviation law they can notify the certification authority of a mandatory fix which will be then required to be applied for users to aircraft operators to apply. If necessary with 0 deadline, i.e. "if the plane is on the ground it's not flying till the following change is applied"
