While I prefer non-upgradable contracts for the same reason, there are mechanisms to reach some middle ground, like:

1) a significant delay between the announcement of an upgrade and the actual upgrade (enforced by the blockchain)

2) a mechanism to opt-out or cash out before the upgrade happens