That's one of the reasons I simply do not allow anything on my phone to auto-update. 98% of app updates these days are effectively malicious. I'll only update individual apps when and if I deem it to be actually necessary.

Except F-Droid. I trust their moderation enough to allow auto updates.