[smacktoward]

Yes, but non-self-updating means tons and tons of sites run by lazy people end up sitting out there on ancient, known-compromised versions of WordPress forever, which is also a security risk (and arguably a bigger one).