Afaik the standard setup of Debian and Ubuntu is to install UnattendedUpgrades with automatic periodic installation of security updates. These aren't supposed to come with functional changes beyond patching security bugs, but there's no theoretical reason a security-patch couldn't bootstrap netbsd and change the entire os. It's code that runs as root.

To be clear: I think this is a great default configuration, and it's been a long time coming - but it's just not true afaik that Debian/Ubuntu won't auto-update at all in the default configuration.

[ed: Debian: https://wiki.debian.org/UnattendedUpgrades

"As of Debian 9 (Stretch) both the unattended-upgrades and apt-listchanges packages are installed by default and upgrades are enabled with the GNOME desktop."]