GUP "subnets" should correspond to real subnets or be documented otherwise

In Endpoint Protection RU5, when a Group Update Provider is defined, the clients learn of available GUPs from the Manager, and then connect to a GUP that is in their "subnet".  However, the client's notion of what is in the client's "subnet" is simply "whatever has the same first three octets in dotted-quad notation".  This model of "subnet" was wrong even in the era of classful routing, and is utterly obsolete in the modern Internet, leading to frequent administrator frustration.  Either the clients' subnet logic should be fixed to work with actual subnets, or else the documentation should be made clearer and the expectation should not be set that the GUP understands netmasks.