That's one nice thing about debian. For home servers I can setup auto updates once and forget about it till the next debian version is released. It will auto install security updates, reboot if necessary.
highly depends on the circumstances if/when auto-updates make sense, but once you have seen uptime in the decades range, most don't want to go back to ephemeral systems.
However one might want to use apt preferences/version pinning if they also use external non-debian repositories to e.g. install a newer version of PHP. Since some repositories keep different major versions in the same repository, an auto-update might otherwise install a version that causes an application to break.
That being said, most systems can probably get away with auto-updates and a little apt preference configuration and call it a day.