Having been paid quite well to migrate to and from WordPress, and to help maintain the WP sites of major publishers, I have to say that this is questionable advice. In most cases in my experience, the publisher has employed third-party providers (at huge cost) to develop frameworks and custom plugins that can easily be broken by automatic updates.
Updates need evaluation and testing in staging sites before they can be rolled out. For publishers, the first install of WP is free - everything after that costs plenty.
Like you said, "major publishers" will have those problems due to custom code. Not the sort of websites where Wix or Squarespace would have ever even entered the conversation. You need to keep context in mind.
And not so major publishers, including hundreds, if not thousands in the top 10,000 sites. So it isn't just the Washington Post, et al. This is why I intervene on generalized advice to enable auto-updates on WordPress. I have seen it cause publishers a ton of money, and have lost a number of weekends when called in to perform damage limitation.
'Make sure you keep everything updated!' has a ton of caveats and pitfalls, that's just the reality.
Having been paid quite well to migrate to and from WordPress, and to help maintain the WP sites of major publishers, I have to say that this is questionable advice. In most cases in my experience, the publisher has employed third-party providers (at huge cost) to develop frameworks and custom plugins that can easily be broken by automatic updates.
Updates need evaluation and testing in staging sites before they can be rolled out. For publishers, the first install of WP is free - everything after that costs plenty.