To me such automatic updates are as obvious as it is mandatory for a plane to be retrofitted or repaired when a similar plane has had a serious incident, and the cause of that is the plane’s technical state. You don’t wait until the captain or the airline feels the plane needs to be repaired. And, of course, the repair may introduce unforeseen problems.
poor analogy - two blogs aren't as similar as two planes of the same make and model. A site running on IIS isn't going to have the same characteristics or security holes as one running on Apache with a different version of PHP and with different plugins - especially if one of them is running multi-site. Its the huge diversity of platform details that make automated updates a risk.