It does matter if it's opt-in or opt-out. It matters a lot, as it's simply a way of making it certain that the needs of the users are being put as a first priority.
in both cases you have to do something to get a more secure state. if its opt-in or opt-out doesnt matter. you could think of opting-out of the not-so-good update-system, too. no matter if you call it opt-in or opt-out, the user has to take action. so its both either good or both bad. but not again these double standards that is good as long as its from canonical.