I feel it's less about security reasons than it is about avoiding downtime and causing outages, especially in the case of not using dynamic routing to re-route traffic in the downtime or in the case of not using high-availability such as HSRP or VRRP. It's also due to a lot of us practicing the belief that if it's not broken, don't fix it, on top of if there are no new features you need in the upgrade and the bugfixes it provides are for features you don't use, there is no real benefit. In addition to this, many organizations (mine included) are contractually required to submit to n-1 and change control, meaning that at specified times per year non-production devices are upgraded to the n-1 release for their model and if deemed to be stable after x amount of time, production devices are upgraded to the same release. If devices were automatically upgraded it would potentially mean that we would always be running "n" (THE most current release), risking that we may be running a beta or even alpha, putting the stability of the environment in jeopardy, and being in violation of proper change control.
My final reason to avoid this is that with some new releases, even if they're just a minor release (for example ASAs migrating from 8.2 to 8.3) there was an entirely new configuration syntax and logic, specifically as pertains to NAT and ACLs, that have a high risk of breaking environments if not converted properly. If the devices were done in the middle of the night without an admin being involved, it could be disasterous until the admin finds what broke and repairs it.