I have two proxy servers which auto update. One in the morning, one in the evening. If the morning update breaks, it flags up the problem, and we can then fix before the evening one updates.
EDIT: To be clear, I'm mostly arguing that you're wrong, but if you have a solution then that'd be great, because I dislike the difficulty in patching these things.
Looks like https://www.citusdata.com/blog/2019/05/30/introducing-pg-aut... will sort out a Postgres master master for you.
I certainly don’t have auto updates on all my servers (wouldn’t be good if a tv program going out to millions of people suddenly vanished — there’s always a glitch when it fails over), I do have it on public facing servers though, so in your case I’d have it on the web servers but not on the database.
And servers might not always break in predictable/alertable ways.
If the only monitoring of the service you have are users telling you, then that’s not a problem you can avoid by not updating.
But, I can minimize possible downtimes, by learning from other downtime reports on a bug tracker.