While most plugin developers are professional and are offering something valuable, it only takes a few malicious intent developers to destroy a site that may have taken years to establish. I know I have plugin conflicts and have to patch some files manually here and there, so if a random plugin updated itself and wiped out a hack and brought down a site, well I would fuming mad. It’s hard enough keeping track of known updates and potential issues. I wouldn’t wsnt to lose a day fixing something I never agreed to. With that said though, most of my sites have auto update enabled on everything, but a couple cannot be updated easily due to the potential conflicts from badly implemented codecanyon plugins that I was naively locked into by bad choices on my part.