Security concerns on using Update Manager without a dedicated site

Yes, I understand your view.

But it’s interesting to note that Joy says this:

Whereas I would never install a plugin that says this:

:thinking: It makes me think the current arrangement has some problems.