We distribute MSDE as one of the possible data storage mechanisms within one of our desktop applications. We do this via a merge module, integrated into our installation program, supplied to us by Microsoft. We install a named instance of MSDE on the user's PC.
Many of our users thought: Hey, I'll just download and install the SQL Server Desktop Service Pack 3 and get myself caught up on all the security fixes and other bug fixes.
It turns out that you can't apply this service pack to an MSDE instance distributed via merge module. This desktop engine service pack only updates your MSDE instance if it contains one the 16 product codes that Microsoft supports. Merge modules do not contain these suported codes.
When our users run this service pack, they wind up with a new instance of MSDE on their machines and a false sense of security.
It took over an hour on the phone with Microsoft Support to find this out. Most of that hour was spent trying to send special command line parameters to the Service Pack install program.
On the bright side, the security updates work against merge module installed MSDE instances and this is what we are recommending to our users.