I've disabled auto update for all apps on my android. However, Facebook and Messenger still updates automatically. This itself raises suspicion of Facebook's control over my phone.
1. Some big features in Facebook/Messenger already exist in the app, and are just enabled/disabled remotely. This is pretty common in most big apps, it's how they can control rollouts. For example, the Snapchat design update: not everyone got it at the same time because the code was living in the app and they gradually enabled it for each user.
2. Wouldn't surprise me if part of the app were heavily reliant on things that can be updated remotely. Chunks of big apps will sometimes be just views fetching some web components. Facebook created React Native, and iirc it can be updated dynamically, like a web site.
When you have lots of people working on an app you have a high probability of introducing bugs. I worked at a company that shipped a faulty update; it looked OK to users, but it was essentially DDoS-ing the servers. Having to wait for the App Store to approve your app to fix things like that is annoying and costly, so people tend to look for alternatives.
