There's an awkward tension between auto-update and fixing security bugs. If platforms don't automatically update, users don't get security fixes. If they do update, you're giving the vendor RCE power.