Comment by prmoustache

I am talking about control, I am not talking about disabling automatisation of updates.

You can have automatic security updates with delay between non prod and prod environments so that you can detect failures or possibly intrusions.