most of my machines use unnatended-upgrades

Increasingly software is distributed by "curl dodgysite.com/get.sh|sudo bash -", no different to running "install.exe" on windows

Surely Windows Update is a vetted repo as much as arch or debian