Only security updates (v0.0.X) install automatically. Version change updates (vX.Y.0) always require a site owner to explicitly install them.

If you are doing things in WordPress that break with a security patch, you need to re-examine what it is you're doing.