That said, valid confusion existed about how it works. By default, only very serious OMGWTFBBQ security auto updates occur for plugins.

@GB330033 a few.

@GB330033 you are good.

@GB330033 Yoast SEO plugin had major security hole. WP forced a security update.

JP had to prepare ~10 or so patched versions so that every vulnerable version was patched with zero unrelated code.

From being behind the scenes during the Jetpack issue, the WP security team is extremely conservative on what is in an auto security update.