Before we can auto-upgrade people we need to figure out how to do so in a way that's fool-proof. Can you imagine the outrage if everyone woke up one morning to broken sites because of an auto-applied update?
I agree. But imagine the outrage when your schema is wiped out. How about a wordpress release which can automatically "disable" the feature/page/plugin/script that express the vulnerability? And throw in an SMS page when an update happens so it wakes them up right away instead of waiting for them to discover it in the morning.