Would it be better to disable auto-update of add-ons? What do you think - what is more risky: a) manual update (and risk of 0day attacks) or b) auto-update (

Would it be better to disable auto-update of add-ons? What do you think - what is more risky: a) manual update (and risk of 0day attacks) or b) auto-update (and risk supply-chain attacks)?