I think automatic updates for a typical all-in-one home router is totally OK, and preferrable, for people who don't have the know-how to improve on it (because I'm not an opsec professional or hobbyist). It's unfortunate that these are also the people who face extended outage when something like this does go wrong. They can't fix it themselves, and the nephew that can might not be available for days.