Obviously if you know what this is you can turn it off.
This sort of subtle authoritarianism in the name of "security" is quite frankly extremely disturbing, and the companies are using it to force what they want by bundling plenty of other highly disruptive and completely-non-security changes too. I could go into a more political direction here, but looking at some of the other changes that have happened to society in general lately, I'm not surprised at all. Disappointed, but not surprised.
But, there’s a difference between auto update by default and forced updates. And there’s, again, the option of buying the same thing with no internet connection—pretty much nothing you own needs to be connected to the internet at all.
Case in point: when Chrome throws a TLS error, you could type "danger" to bypass it, but they had to change it because businesses started teaching users to bypass errors blindly.
Not exactly apples to apples, but similar enough in my mind. If users blindly disable updates, they won't be updated when there's a major security patch.