For the use case of the clueless consumer, auto updates are better. The instant you start requiring a user to manage their own update process you are requiring a higher level of intelligence and proficiency than the vast majority of the population possesses. Given the choice, the idiot consumer will just never update and leave themselves wide open to malicious actors to do whatever they want with the victim's machine.