In reply to yolabingo.

I'm not entirely sure how it works but to my understanding Auto Updates for plugins and themes are a (disabled by default) built-in feature on WordPress installations. The Security team can override this and force an update for a particular plugin if they decide it's worth doing so, such as in this case, or when the Jetpack vulnerability was found last year.

The link you posted describes how to enable these auto-updates on your own WordPress installation if desired, although normally this shouldn't be necessary, since manually updating them gives you a better chance at testing and checking the update doesn't break them, or at least find out it that happens.