The Debian team recently published an update for Debian's system installer. The new system installer, which will be used to set up Debian 10 "Buster" offers a number of changes, perhaps the most interesting one being enabling automatic software updates. "The unattended-upgrades package is now installed by default through the pkgsel component. The intent is to ensure the automatic installation of security upgrades. Feel free to help documenting this in the release notes!" According to the corresponding issue ticket, it looks like it will be possible to disable automatic updates, possibly at install time.