In reply to Otto.

Thanks Otto :)

I had actually read the documentation not that long ago, which is rare for me brother! Even with a re-read just now, it doesn't feel like it clearly states what this filters purpose is, when it why/when it would be used.

There is no distinction between normal updates (major/minor) and security updates.

Even the filter is just called 'auto_update_plugin', which someone might turn off (but would want critical security updates), or leave on for said critical security updates (but worry that plugins will auto update for major/minor releases).

By default, automatic background updates only happen for plugins and themes in special cases

It my opinion that 'special cases' needs some form of definition. As a site owner, if an external web service wants to update files on my server, I want to know under what circumstances.