>  Turning on automatic software updates from Google would make me vulnerable to that threat. Using MicroG instead of Google Play Services would make me less vulnerable to that threat

I would say that any auto-update mechanism is a threat, so in both cases you would disable auto-updates.