Auto-updating should be tied to audits by reputable third parties, to sign off on a release. At least two. Why isn’t this fone?
This culture of Tweeting at 5 am to 5 million people before the truth has a chance to get its pants on is defended in the name of “freedom of speech”, but I much prefer the peer review gated approach of science. Not one monopoly gatekeeper but at least 2 reputable ones, before your OS or package manager allows the download (but users can override it if they insist). I think rpm and yum do that..