My first post here, but I thought it timely to add this. This unattended-upgrades, up until 4/29, been setup to check for security updates only. In short, on that day (or rather, at 1am my time), it updated itself along with its configuration. You can see this in the log sample below. This of course wreaked some havoc on my production systems when it updated all sorts of packages and nuked everything. Needless to say, this feature is now permanently DISABLED.
2017-04-23 04:49:04,987 INFO Allowed origins are: [‘o=Ubuntu,a=xenial-security’]
2017-04-27 15:46:07,068 INFO Allowed origins are: [‘o=Ubuntu,a=xenial-security’]
2017-04-28 12:35:25,599 INFO Allowed origins are: [‘o=Ubuntu,a=xenial-security’]
2017-04-28 12:35:29,950 INFO Packages that will be upgraded: unattended-upgrades
2017-04-30 03:19:04,933 INFO Allowed origins are: [‘o=Ubuntu,a=xenial’, ‘o=Ubuntu,a=xenial-security’]
2017-04-30 15:35:41,094 INFO Allowed origins are: [‘o=Ubuntu,a=xenial’, ‘o=Ubuntu,a=xenial-security’]