Minor updates hardly break sites and 3.8.2 did not. One kind of security updates is hardening. A hardening may break functionality in some cases. Fixing a regression fast and smoothly as also one of the reasons auto updates is beneficial.

One of the arguments for not wanting auto updates is that when doing a manual update you can test your site and eventually and immediately revert or fix any breakage. Not many would immediately discover that Quick Draft was broken. This would only be discovered when someone actually tried to use it. In the mean time you would have manually updated all your sites, this being an important security update. Only allowing manual updates would not have made a real difference.

The decision not to include a UI for turning off automatic minor updates is still wise. Finding a plugin for exposing this option, or a code snippet to disable it blindly, is easy.