Which affect the OS mostly and not individual apps. Funnily enough OS updates are usually not automatic. Which I think is a good thing because vendors keep mixing them with "feature updates" which end up making things worse (looking at you Samsung).

I'd love for Google to take away the security update channel from the phone vendors and auto-update ONLY security-related things through that.

So what happens if you are on an old version, a security issue is discovered, but they only fix it in the new version?

Yeah and missing security updates was WAY more common, autoupdates is the lesser of the two evils by far ...