LOL uh yeah - Configuring Automatic Background Updates kind of says it all. ;)
https://codex.wordpress.org/Configuring_Automatic_Background_Updates

By default, automatic background updates only happen for plugins and themes in special cases, as determined by the WordPress.org API response, which is controlled by the WordPress security team for patching critical vulnerabilities. To enable or disable updates in all cases, you can leverage the auto_update_$type filter, where $type would be replaced with "plugin" or "theme".