In reply to Chuck.

The entire auto-update infrastructure is a standing security risk as it allows a third party to inherently install or upgrade software on your system. The risk isn’t limited to the fact WordPress has the capability to roll out a major upgrade to what could be considered an abandonware website.