As the article points out, one issue is that the official Docker container for PHP has this configuration.

However at least in principle all of the affected versions [0] could be automatically updated. Not sure if they have set it to auto-update as far back as 4.7 though.

[0] except 4.9.3 which has a bug in its automatic update mechanism.