Auto update is itself a security issue because it means the app can overwrite itself.

This is not a security concern with client apps like browsers because they don't run on a publicly listening server. Wordpress does.