Ubuntu's system is the best around.

Mozilla is walking itself out off a cliff.

WordPress is well-loved, and has an inner circle that used to be so small as to be a singularity. So like your mother, it could get away with crap.

Just modify the current Update menu item in Admin so that it is the users de facto "Opt in" agreement. It works mostly this way now ... except for that nagging issue of it taking it upon itself to check certain 'vital' WP info, just because you happened to log in to Admin.

WP gets away with it because they're everybody's trusted sweetheart.

As WordPress grows, as inner responsibilities & authority is distributed and delegated, practices like these become greater liabilities.

Facebook is sleazy. They're successful, and powerful, and impressive. But they suck. Nobody feels sweet for Facebook; nobody trusts them to take out the garbage.

Downside, yes, the installed WordPress base ages & decays. There will be exploits, using stuff that has been fixed in recent updates ... which some people can't be bothered to check for on their own. That's why WP does it for them ... to protect WP's good name, to minimize those painful security traumas, of which there have been a few.

Goose-stepping release cycles are a big part of the problem. Recently, we have watched it morph into an outright frenzy. Google goaded Mozilla into clinical hysteria, and they're defending it to the hilt. Release-madness pushes coding, and deprecates testing. "Upgrades" replace validation.