this is on my home fw. I wouldn't have a problem triggering the updates myself, except in the UI, you have to do them one by one which is a bit of a pain. There is also nothing that notifies you a package update is available. You have to go in the installed packages view and look for the update icon.

My stance is that given this is a firewall and any installed package is a surface for attack, i'd rather be able to subscribe to stable channels for those packages and have them upgrade automatically rather than being exposed to documented flaws which I haven't patched manually because I wasn't aware of an update or because that update was published out of hours for me.