The security features were listed in the initial announcement post of the auto-updater:
We added the following security features:
3 out of 4 DNS server must indicate a new update is available.
The hash of the downloaded binary must be the same as here: > https://web.getmonero.org/downloads/hashes.txt
hashes.txt must be signed by a maintainer.
An extra ...