In reply to Miroslav Glavić.

If your site has a security vulnerability, I'd say it's already broken.

Personally, I'd rather have my sites go down completely because of a botched update than have a vulnerability sitting there waiting to be exploited. The risk of the former is losing traffic and a minor hit to my reputation; the risk of the latter is having all my data destroyed, infecting my visitors with malware, being used to send spam, theft of sensitive information (mine and my visitors), a big hit to my reputation, etc.

In reality, though, that's not even an issue, because the Core security team is extremely careful about how they push automatic updates for plugins.

If you're running a mission-critical site, then you can always disable automatic updates and apply them manually, but that's not the type of person the feature is aimed at. Anyone who would incur significant losses by their site being down should have resources dedicated to security. Automatic updates are for the 99% of site owners who don't have those kinds of resources.