Auto-updates prevent site admins and site managers seeing any of the new benefits that are shipped with plugin and theme updates and they prevent them knowing whether security holes have been patched. This is a disservice to end users. How are site admins and site managers to know to check for data breaches or content graffiti? When plugins that integrate with 3rd party services are updated and they require new API keys or re-authorisation with 3rd party services, how do site admins and site managers know they need to act unless they get a notice to tell them?

The auto-update needs a rethink before it’s universally enabled or before it’s generally available to be enabled.

1) Website developers and site maintainers need a way to disable auto-updates through wp-config.
2) Plugin and theme developers need a simple way to notify site admins of feature additions and security patches via an admin messages/notices page in the Dashboard. Not just a Dashboard notice but an inbox for admin notices.
3) Changelogs need to be emailed to site admins and site maintainers.
4) There needs to be a way to set the recipient of update notice emails (and error emails) in the site settings admin page.
5) The system that checks whether a site is down needs to be external to WordPress core. This way the error messaging system will not be dependent on the functioning of WordPress core.

I’m about 50/50 on whether auto-updates are a good idea. Maybe a little more against than for. I will be more comfortable with auto-updates when the feature has been given more thought. It’s a good idea but badly executed.