> Why don't they all auto-update by default for critical vulnerabilities? Because it costs money for manufacturers to implement and maintain this functionality

> Why don't they all auto-update by default for critical vulnerabilities? Because it costs money for manufacturers to implement and maintain this functionality, and there's (currently) zero benefit to them for doing so and (currently) zero repercussions for doing what they do today after they sell you a device: nothing.