At that point you've got "well, that's not worse than anything else, then" security. The NSA, for example, could MITM your computer's connection to Ubuntu's update servers, FISA a sysadmin for a copy of their package signing key, and inject a "critical security update" only for you. Auto-update systems are suspicious as a whole, now, and should only be trusted in general as a compromise to convenience, and the statistical unlikelihood of you being attacked.

But this is why risk assessment is part of choosing and using crypto.

If you think the NSA is after you then all bets are off and whatever you're doing is probably not working because most people don't have an armoured bunker with armed guards. We need to be careful to differentiate between active NSA snooping (in which case anything we do is probably weak) and passive snooping (where we just want to make it expensive enough for them to not bother with our communications).

But if you think the FBI is after you then you'll want to avoid something that can be done by a court order - such as your encrypted email provider being forced to serve you a malformed client that allows law enforcement to view all your communications. This is a real risk, and is what happened to Hushmail.

If you're running a decent linux you can turn auto-update off. No browser will let you do that.

All the portable-app versions of Chrome and Firefox (for example, the Firefox that comes with the Tor bundle) have auto-update disabled, for both the browser, and included extensions.

I think that was in reference to a web app.