Per the ANR rulebook:
Upgrades are improvements to a server that provide the Corporation with a wide variety of benefits and bonuses.
The Corporation installs upgrades in remote servers or the roots of central servers. Upgrades are the only card type that can be installed in the root of a central server. An upgrade is not active until it is rezzed by paying credits equal to its rez cost.
There is no limit to the number of upgrades that can be installed in a server. When the Runner accesses an upgrade, he can trash it by paying credits equal to its trash cost."
The upgrade is just another card in the remote server, and because of its placement, may be used as a bluff by the corp player (the goal being to make the runner think it may be an agenda or asset). This technique becomes self-limiting when you begin to place advancement tokens on said agenda or an asset (if possible), but that does not negate the fact that the runner will have to pay (in clicks or credits) for the privilege of exposing your upgrade (and then perhaps trashing it).
IMHO, the rulebook does not makes this as obvious as it should be, and I learned this nuance by watching other seasoned players during a friendly game.
Thanks. I've been pouring over the rulebook and can't find that wording on installing to central roots or simply in a remote. Could you quote me the page you found that?