The distinction is between auto-update and user-chosen update. Some users strongly prefer all software running on their owned hardware is incapable of auto-updating in a way that bypasses explicitly requiring the user to choose to update each time.
It may come across as a nasty dark pattern if a user must opt out of auto-updates (which is loosely what Normandy is, if you extend “auto-update” to also mean tacit enrollment in an experiment).
Instead it should be off by default, with a clear and unambiguous description of the functionality on a menu page if a user wants to opt in.
For example, I am a very privacy-focused browser user, relying on many special settings & extensions. Despite frequently reading about browser updates, I had no idea Normandy functioned like this, nor that it was enabled by default, until reading into this current Firefox certificate bug.
Upon learning what Normandy is and that it is opt-out by default with unclear connections to the traditional privacy dropdown menus to disable experiments or usage stat sharing, I feel that Mozilla violated my trust in a profound and deeply upsetting way.
The one that is remotely done for you, without any action on your part.
Typically, a user has to click the installer or use package manager or something to get the update, it’s their decision they make locally. If a setting is in place where this decision can be made somewhere else, it’s now a remote thing, a remote update. Quite useful thing in some cases and one of the things that make SaaS possible in the first place.