I've found this comment: Any reason not to allow automatic updating for an app? - is that safety feature documented anywhere ? I'm about to turn on automatic updates but I don't feel comfortable doing that without a firm proof that it won't compromise security.
It's not documented somewhere. But only updates that don't change the permissions are done automatically. If there is a change, the update will have to be done manually.
But of course there is no gurantee that this will always work this way, because of bugs or design changes. If you are paranoid, turn the feature off. (But then, how could you trust Android that the permissions that are shown to you are enforced?)