In reply to Dave Navarro Jr.

I have turned off auto-updates on the hundreds of live sites I manage. I don't feel that I can trust WordPress to auto-update itself and not cause harm. I don't feel that I can trust those who make the decisions about what gets released as a security update. I don't feel they are rooted in reality.

I will continue to leave it enabled on my dev/staging sites. And just as I do with new releases of WordPress, I'll test them there first before rolling them out to live sites. And I will encourage others to do the same.