In reply to Ian Dunn.

It's great that you're so proactive about keeping your sites secure, but you're in a very tiny minority. If you're comfortable with that level of responsibility and are dedicated to doing it, then more power to you, but the vast majority of site admins will never do anything close to that.

We can dismiss them as being irresponsible, but that doesn't fix the problem. Hacked sites aren't just bad for the person being hacked, they're bad for everyone. They hurt WordPress' reputation because the bottom-feeders in the tech media seize upon every opportunity to blast a "New WordPress vulnerability puts millions at risk" headline, and they're used to manipulate search engine rankings and distribute spam and malware, which affects everyone.

We need a way to patch security vulnerabilities in plugins without "lazy" admins having to be aware of the problem, understand it, and take action (because those things will never happen). Automatically pushing security updates for plugins solves that problem.

If you have privacy concerns, no problem, just disable them and install the updates yourself. No one is being forced to use them, they're just a feature that's enabled by default.