Given all that I came to ask for advice. Should we enable unattended-upgrades in Debian for baremetal servers (the same way as it is enabled for cloud VMs)? Mind, that this installation process is very automated, we ask users only on their partitioning preferences, hostname and ssh public key, so we can't simply 'ask user'.I suggest you enable them, and document for your users that you have done so and how to disable them.
Can you give arguments in favor of this option, please?