It's a balance, at the end of the day. I won't be auto-updating on my server because it's not hard for me to do that myself. But if someone is just running a site where HTTPS isn't particularly important (a personal blog, say) then the convenience might outweigh the very slight security concern - better they are using HTTPS at all, if the alternative to convenience is HTTP.
