As always, I'll just keep saying that users need options and control, obviously if they also take responsibility for the consequences of their choices.
Automatic minor updates on by default? All right, less savvy users will likely welcome that. But have a setting in core to disable this behavior for those who wish it. And, alternately, in the same place, also one to also have automatic major updates turned on for those courageous enough for that.
Site gets hacked as a result of having updates off and not applying one that patched the vulnerability used in the hack, it's the user's fault. Site has any sort of issue, including even a brief downtime at a wrong moment while the update itself takes place even if everything otherwise goes well, not to mention something more serious as it happened now, due to updates being automatic, it's WordPress' fault. Simple.

It's a piece of software specifically aimed at being used by many millions of people, it powers a large chunk of the entire web, the fact that all those users have wildly differing needs and preferences and skill levels must be at the front of the developers' minds and the design policies must revolve around that, not relying on plugin developers to always fill in gaps, and at times even trying to discourage them from doing so when it comes to certain features.
And security may or may not trump all. That's for the user and, depending on the severity of the risk, the hosting provider to decide.