I'm not happy with how patch releases (the .Z in X.Y.Z) are now being used for more than critical fixes. By default, WP installs patch releases automatically. The original implicit promise was that this mechanism would be used to maintain security and fix critical bugs. But over time, that scope has progressively widened. Now it's being used for all manner of general improvements. That means that it's not just delivering small, easy-to-understand changes, but things of wider and harder-to-evaluate scope.

It also means that site owners are forced to make the unpleasant choice between 1) disable automatic security updates (change the default setting) or 2) enable them, but at the risk of breakage at any moment when other updates are pushed to your site. There's no way to opt for "security updates only, please". Should you opt to turn off security to allow more time for testing of the other changes and their impact? Automattic shouldn't be forcing people to make this choice.

For similar reasons, development of the TwentyNineteen theme should be done independently after release, as a normal theme update not tied to the patch release cycle, so that site owners can evaluate changes to it independently of critical bug or security fixes.