This requires a definition of what is “auto update”, but in the most general sense, a plugin can do whatever any other part of wordpress can do therefor a plugin can trigger an auto update without human intervention.
On the more practical side, this is very unlikely, and hiding the indication should be good enough for all practical usage. Still hiding information is usually something that will come to bite you back in one way or another when it is not your own site. It is just not your site and you should not prevent users from having full control of their site.
If you have a contract in which you are the only one responsible of adminning the site then the proper thing to do is just not to let any one else have the capabilities you do not wish them to have, or just have no one else in admin role (not sure how that works with comment moderation, therefor the capabilities path might be the only way to go).