Out of all software to disable auto-updates on, email clients are probably the riskiest, given how much use they get and that they are the number one vector for

Out of all software to disable auto-updates on, email clients are probably the riskiest, given how much use they get and that they are the number one vector for delivering malware. There's already been a privilege escalation found this year in Thunderbird.