Nothing stops an auto update mechanism having gradual rollout strategies
If there's auto-update, it should certainly be rolled out gradually.
How about auto-cripple? Where developers can tell old versions to stop functioning
You
definitely don't want to tempt an attacker with the chance to cripple everyone else, while they attempt their 51% attack!
The power to deprecate old versions is already available to the network as a whole, since each node can refuse to connect to instances running an outdated version of the protocol. The network is where that power belongs - not with the developers, although developers of course can influence it by releasing new versions that are important enough to the network that it becomes worth deprecating older versions.