“WordPress.org has the ability to turn on auto-updates [ for ] plugins”

Where is that explained to the average user, and where can it be toggled off?

While I appreciate the security reasoning behind this functionality, its in essence a hardcoded backdoor. Plugins can be updated against the will of the site owner.