Totally agree on all points, I'm just letting folks know the recommended solution if they choose to use Dependabot.
As a side note, automerge is... complicated. I've always felt that having it means that people will be mad when it does something bad (e.g. automerges the inevetible npm credential theft update), and they'll be mad if it doesn't exist because they're so sick of the unending stream of PRs, so you're kind of damned either way. At this point, I fall on the side of "let people do the unsafe thing so they shut up about not being able to do so" but that's not the side the security team generally falls on.
Disclosure: one time PM on Dependabot