There are lots of people who will never update if asked to update at their leisure. I think it’s far better for user security to have updates be forced by default, with the option to schedule them yourself.