You cannot always be too careful if you use your wallet in the same device you browse the internet with. Take note that anything online is prone to attack, so even if you are careful and update your wallet to the most recent version, your funds are not safe. If you are storing a large amount in BTC, then the safest option is to use an offline wallet, and that is either a hardware or airgapped wallet.
I hope you aren't connecting it to the internet when there is an update. Do you copy the installation files of the new versions on a USB from your internet-connected computer and move it to your airgapped one? That too could present some risks if your internet-connected machine isn't safe and is perhaps malware-infected because of something you did there that you shouldn't have.
Everything connected to the internet will be an invisible loophole, especially if the device used is already infected with malware that is not even detected by antivirus (maybe a new type of malware) or malware like Xenomorph which was horrendous because it was not detected and could infect many devices to steal important credentials and several crypto wallets on the device.
Quite skeptical when all these loopholes allow the Electrum wallet or any other wallet to be hacked.
-snip-
should new scripts unknown to cold wallet appear the latter has to be updated and USB threat takes a stand. The same threat may be relevant at initial Electrum installation on the airpapped machine. That is why for the cold wallet I would prefer to use Electrum already incorporated into Tails distro . This Tails in turn could boot up the airgap machine and be updated via download of new distro release.
Electrum which is incorporated with Distro Tails OS is indeed quite good because it has been perfected for the privacy and security of the Electrum wallet.
Creating a bootable USB Stick Tails OS in which there is an Electrum Wallet is a DIY Cold Wallet that can be an alternative to personal wallet security besides using Hardware wallets such as ledger and Trezor.
But whether the OS distro update will run automatically like the appearance of Pop up, or need to do the Command manually first on the terminal.