Firefox 3.5 is no longer supported, and the last security patch was sent out last month.
Says Christian Legnitto, Firefox release manager:
We are treating the automatic update checkbox enabled as a 'Yes, I want Mozilla to keep me updated. Previously as a courtesy we had people opt-in between major versions due to the potential jarring nature of the update. We feel the difference between 3.5 and 3.6 is not severe and with 3.5 reaching end-of-life 3.6 is the security update for 3.5 users.
The browser company says most users have auto-updates selected.
Mozilla does admit they would prefer that 3.6 users upgrade to Firefox 4, which was launched last month to much fanfare (and many, many downloads).