It's a known hard problem. Capability based permissions vs access control based permissions. I would trust wordpress to keep their signing keys safe.
What signing keys? Wordpress's automatic updates aren't signed, so your trust is horrendously misplaced.
Someone already did the work for them to implement it[0], and rather than commit it, a Wordpress developer wrote a blogpost saying signing isn't really that important[1].
[0] https://core.trac.wordpress.org/ticket/39309
[1] https://medium.com/@photomatt/wordpress-and-update-signing-5...
Since this is done extremely rarely, that leads me to believe that its more of a cultural problem (perhaps with the WordPress team, even) than a technical one.
Spent 5 years in shared PHP web hosting, can confirm that most of the people are muddling through with the bare minimum of understanding to get WordPress going.
I've found that clicking a comment's timestamp to view a permalink to it will usually allow replying.
That is inherently not the default for wordpress, and at that point you may as well be installing via deb/rpm.
I didn’t say scheduled updated are bad I said a self writable web app is a fucking security nightmare.
If php has permission to extract an archive with new files over the current ones, it has permission to write a malicious file over a current one.
I’m not talking about a vulnerability on the wordpress central infra that delivers a malicious update via the legitimate update path.
I’m talking about a vulnerability in the millions of wordpress installs that have filesystem permissions to overwrite themselves, to facilitate “auto update”.
I don't do as much with WP these days, but have worked with it some over the years, and work with multiple folks in the geographic area who primarily do WP work (friends with folks who run WP meetings and do all-WP work, etc).
I've seen dozens of exploited systems in the last 2-3 years, and been asked to help 'clean them up'. Every single one of those was some variation on some bot exploiting some code (in core or in a plugin) that allowed for some obfuscated code to be written to a publicly accessible directory, with names like "includes.php" or "sys.php" (things like that) - common words that no one who is not a WP expert would even think to question in the first place (no one leaves BACKDOOR_EXPLOIT.php as a file name, for example).
Yes, you can install stuff like wordfence and similar tools to continually scan your disk to look for 'infections', but... why allow those to be written to the drive in the first place? I know the answer is "convenience", but it's been a huge community price to pay.