While google play certainly helps with these issues, I currently have both whatsapp and firefox installed from their respective websites by downloading the APK directly. WhatsApp is happy to notify me when there's an update, and it's one click to download and install. Firefox downloads the update automatically, and again, it's one tap to start the install. Mozilla crash reporter runs when it needs to, etc.

So while google play gives you these features "for free," it's not impossible at all to have them without. Only unattended upgrades requires special access, and to be honest personally I never want things modifying what's installed without asking.

The thing is, you know what you're doing. He makes a fair point in that his target audience is people who don't know what they're doing, which is inevitably going to lead to people downloading "brand new updates" that are full of malware, or worse, backdoored.

Some of these are solved by setting up their own repo (though you can't force users to update in F-droid). Some of the tracking things can be handled, I believe, if they were built out and opt-in.

https://f-droid.org/wiki/page/Setup_an_FDroid_App_Repo

Moxie choose the wrong license for signal, it doesn't reflect his intent.