I think we’re at the point where creating defect free software is prohibitively expensive and the externalities of having a vulnerable system are not borne by the users of that system. Given that, software has to be considered a living, evolving system such that we can’t prevent automatically updating no matter how much an individual wants it to be so.

Every browser with the "check for updates" setting left un-checked.

Try K-Meleon