Considering what goes on with the user’s privacy and other rights that EU and some other parts of the world try to protect (with more or less success), I think that auto-updates (even minor version) are currently completely illegal, and are done using implied consent, which is known to be illegal when gathering user data or doing something on users behalf.

If core team working on updates need something to do, I would suggest making changes to WP installation to ask the user to agree to the updates (select between minor and major), store that in the database and have the option to change it in the plugin settings. That can be considered legal explicit consent to do something on the user’s behalf.

Sending major updates to outdated WordPress websites is totally unacceptable for so many reasons, and in most cases I am sure, it will end up on the broken website. As few people pointed out already, outdated websites are outdated for a reason: the owner doesn’t care anymore or is stuck with the outdated plugin/theme/customization that will break with the new WP version.

And the fact that WordPress.org can do this doesn’t give anyone right to do it, we all should be scared with the implications, especially, since updates are even now done without any consent.