Not jumping further into the security debate since this aspect has been discussed extensively already but overall, Aurora Store is great for its purpose: it does what it's supposed to do, lets me do it efficiently, and gets out of my way when I'd rather be busy with something else. What more can one ask for?
On a general note, it's amazing how people have been conditioned to accept the flood of incessant updates of trivial user-space applications as the "new normal." Does a flashlight app really need to be updated on a daily basis? What ever happened to the idea of applications striving to be bug-free, well-tested and feature-complete before public releases – especially in the era when some of them are merely glorified WebView wrappers?
@DeletedUser495 is making some great points here, and I'd like to develop upon them. Personally, I'd never let Play Store apps auto-update, for a number of reasons:
It is common for updates there to introduce anti-features or remove functionality. Occasionally, developers go completely rogue and sell out to shady adware outlets. A purported update can turn out to be an entirely different application, only reusing the same package identifier – along with the permissions it was originally granted.
Even without malice, there is incompetence. Updates can introduce bugs and break things, so I don't want them happening when I might need an app for a critical functionality. For example, I had a bank app update render it not functional while I was travelling and needed access to it so that I could transfer money between my accounts. It was a nuisance.
Background updates may clog the data connection at an inopportune moment when I need all the bandwidth for something else, or drain the battery faster when I'd rather have the phone keep all the juice for as long as possible.
GrapheneOS in particular, but even up-to-date vanilla, stock Android is generally secure to the point that not updating a user-space app immediately is unlikely to result in a system-wide security issue. (Although this might be somewhat different for stock Android in that some system app updates are also delivered through the Play Store.)
In general, I am of the old-fashioned view that any computing device should do what it is instructed to do by the operator, as opposed to running all kinds of persistent state-altering operations autonomously in the background. While the Play Store is robust and secure as a distribution mechanism, it is also a malware-infested place, so the quality of what it distributes cannot be taken for granted, which is why I'd rather oversee the stuff it distributes to my device.
Disclaimer: This is obviously not advice I'd give to everyone: non-technical users should probably leave automatic updates on since this is still better than forgetting about any updates at all. But I've found the approach of manual updates every couple of weeks to be best suited for my specific usage scenario. It also helps that enough people jump into updating at earliest opportunity (or it happens automatically for them) that any bugs or issues will likely become apparent after a week or two since an update has been released.
As for the app updating itself: Aurora Store is a Play Store client. Since for obvious reasons it isn't listed on the Play Store itself, a self-update feature is completely tangential to the main functionality and purpose of the application. It is also redundant as there are other means to accomplish that: personally, I have it set to update via Obtainium with a couple dozen other apps.
All of the above is obviously completely different than GrapheneOS updates, which can be trusted not to introduce anti-features or break things, while at the same time being critical for the continued security of the system, so the small cost of having them potentially interrupt user actions is far outweighted by the benefits, which is why having the GrapheneOS App Store set to auto-update everything is the best course of action. I can't really see how a parallel can be drawn between the two as the previous poster has been trying to do: the quality of what is distributed by the GrapheneOS project is simply incomparable to what is being tolerated in the Play Store, including as updates to formerly legitimate apps.