I can understand those who say that they prefer not to be forced to update.

But on the other hand, I also would like less insecure versions of wordpress and other net / web capable software running.

Maybe have the "no update" command be something that is not newbie friendly. Maybe a complex command which is slightly different depending on the domain name, so that there isn't a copy / paste command in the wp-config.php or a single tick in the admin section to disable updates.

This will at least "proof" that those who stop the updates probably have some skills and maybe even know what they are doing.