highly depends on the circumstances if/when auto-updates make sense, but once you have seen uptime in the decades range, most don't want to go back to ephemeral systems.
However one might want to use apt preferences/version pinning if they also use external non-debian repositories to e.g. install a newer version of PHP. Since some repositories keep different major versions in the same repository, an auto-update might otherwise install a version that causes an application to break.
That being said, most systems can probably get away with auto-updates and a little apt preference configuration and call it a day.
Yes, I'm assuming any kind of updates, security related or not, might be unsecure given less eyes looked at them due to their freshness.