Yes, address changes need to be performed at an enrollment center. If the officer really could have revoked your membership because you were in actual violation of the rules, don't you think they would have? All bluster, that one, but correct in your obligation to update your residential address.

I did my update at YYZ (NEXUS) and my wife's at PHL (GE) when we moved. Both times it was over 12 months since the move and I had used the program many times in the interim.

The CBSA officer at YYZ told me that it was fine since I had at least promptly updated my mailing (but not residential) address online to the new address; the CBP officer at PHL told me that I should be able to do it online (WRONG) and that she didn't need to do it in person (also WRONG) but took her passport and DL and went back into the office and updated it for her when I insisted. Nobody said a peep about risking revocation because we waited a year.

Both were done without an appointment. I had to talk my way past the speaker at PHL (you know if you've been to that GE center), who also told me that she didn't need to make the update in person (WRONG). YYZ had a sign-in clipboard set up just for drop ins like me, separate from the interview queue.