If you turn auto-updates off, you're just reinventing early 2000s desktop security and attackers everywhere will thank you. Updates need to be automatic but there needs to be stricter rules about notifications to users about changes in ownership or functionality. A huge fraction of this would go away if corporate liability didn't allow hiding all of this in terms of service.