When I filed a bug report on May 13 (which was cancelled) I was told:
This is deliberately staged. Download manually or wait.
After a week (May 20) I wrote back and was told the next day:
We usually wait for feedbacks before enabling auto-update, and the
feedback for 2.2.5.1 were mitigated to the the least. We hope to address
the concerns with 2.2.6 (most likely early this week), and we will
probably enable autoupdate shortly after.
It's now been almost two more weeks and no sign yet of 2.2.6. I wonder how much longer will it be before the Malware Developers blow a hole through 2.2.4.