There may be a way to try to detect the issue and help people through the problem, but it can't be "fixed" because it isn't broken at our end--the issue is that the users' firewalls are not only overzealous but don't give them the proper choice to re-allow an updated program to access the Internet.

The problem isn't the update you see, it's the firewall. Many firewalls that allow access on a program-by-program basis have some kind of hash that detects viral infections modifying the programs. Typically if a program that isn't on the list tries to use the Internet, the user will be prompted if they want to add an exception to their firewall so that the program has access, and it's during this process that most of them forget to turn off the rather useless hash feature. Once the program updates and the firewall detects the change, the proper procedure is for the firewall to re-prompt them instead of silently denying the program access. Apparently one or more major firewalls (the Windows firewall being a likely culprit) is not doing this.

In theory we can detect a firewall just based on the fact that ports won't open. What we can't do is force the firewall to update its info. There's no way for us even to know which particular brands of firewall are running. And if there was, or there was some standard way to communicate with the firewall, the firewall would still have to prompt the user (for safety) which it ought to be doing in the first place when it detects the program change it cares so much about.

An alert during the update would be pointless for the majority of people who don't have lousy firewalls. An alert upon actual failure to open a port would be more useful.

This has happened to me a few times, but it seems to work if I relog.