I'm a strong believer, however, in making sure the user has visibility and control into it, so both methods (manually add/remote/check status & API) ought to be available.
Make that API call pop up a dialog or something to ask the user for consent.
It's like governments. It can be a surveillance state ruled by a dictator where everything is regulated and everyone is spied on for the sake of "safety". Or it can be something that offers all the freedom you could possibly want, including the freedom to shoot yourself into the foot, both literally and metaphorically.
When I was younger, I would probably have loved an Android phone but my 2 attempts with Android phones (like the Nexus) recently were terrible compared to my iPhone. I was constantly messing with things to try and get them working, I had to stop tasks and apps constantly in the app manager (and even had to download a different app manager), and was constantly waiting for things. Now, I care more about just being able to pick up my phone and know that it works to do what I want to do at any given point. I'm done messing with things.
I don't know much about the money/license part UX because I've never paid for software myself. But developers probably won't want to delegate licensing to the OS because this would make it all too easy to crack — it would only take one very simple patch to disable license checks altogether system-wide.
edit: Sparkle already uses a standardized feed format (https://sparkle-project.org/documentation/publishing/). So basically the only thing that's left is to move the update checking and installation logic to the OS as opposed to every app containing a copy of it.