Nothing is safe in absolute terms.

I assumed a certain line of defense in not having auto-updates and wish Google never had switched the default from off to on. Learning that off is not off leaves the user with zero protection against exit scams even if aware of auto-updates. I wonder if OP was really getting updated from iTunes or from testflight.