Is there auto-updating of plug-ins?

Installing a plug-in and reviewing its code at that point is one thing. But if the plug-in can be updated withut you knowing, then there’s little guarantee of security.

You can automatically check for updates but it's off by default, and still requires a manual click. Also the new plugin review system automatically scans every release.