Unattended application to test. If it passes testing, unattended application to prod.

I still wouldn't do this for any critical service, but for a "move fast and break things" system like Facebook where it goes down and nothing bad happens, sure.

For professionals and buisnesses, I see where you are coming from (although there is an argument to be made for prioritizing security over uptime whenever acceptable).

But for selfhosting/private users? If I wake up one morning and my stuff is not working anymore, I can just roll back to the last good backup and then apply patches manually to see where it goes wrong. Way better to have some downtime when I don't notice (i.e. don't need the service) than having open vulnerabilities when a fix exists.

Yeah, for businesses I can see that, but selfhosting, meh. I have just one personal server firewalled and Wireguarded, so the PHP vulnerability wasn't even publicly exposed. Even so, I have never had any issues with Debian's unattended security upgrades in the last 5 years.

In enterprise environments with a hundred servers, though, you will want to do something else than I do. :)

But even then, don't enterprises run a good WAF in front of their public web sites that would have received the patch automatically?