I think this story also needs to look at wider context. WordPress core, for example, pushes automatic updates – and has used this in the past not just to push limited-scope security patches, but whole new features (e.g. the privacy features in 4.9.6 – https://wordpress.org/news/2018/05/wordpress-4-9-6-privacy-and-maintenance-release/). Some core team members are in favour of promoting automatic updates as much as possible. So whilst I disagree in principle with forcing automatic updates on users, I think it might be a bit harsh of WPTavern to single out one plugin vendor when the same practice is part of every core WP install and more of such things is part of the core roadmap. If there’s an issue here, then it’s not a new initiative from this plugin (which personally I have no relationship to and don’t recall if I’ve ever used).