On average, I believe most users benefit from an automated check for updates. It should be possible to disable it, but we should first worry about keeping users

On average, I believe most users benefit from an automated check for updates. It should be possible to disable it, but we should first worry about keeping users safe. They should still ask first, at first run. I actually enable update checks for a lot of things, if I'm given the option up front. I'll submit crash reports and even periodic telemetry if I know that the crash reporting system doesn't download and run arbitrary code, shows me everything that will be submitted, and allows me to omit needlessly identifying details (e.g. custom kernel strings). Some projects (KDE) make it really hard to submit crash reports, by requiring an account, etc. It must be optional, it must be easy, and it must be transparent. Then users will volunteer crash reports and stats. Respect breeds respect.