Don’t do unattended upgrades. Neither host nor containers. Do blind or automated updates if you want but check up on them and be ready to roll back if something is wrong.
People should use what distro they know best. A rolling distro they know how to handle is much better than a non-rolling one they don’t.
You can run a command to update docker containers too. And there’s this thing called cron that can run commands periodically. But maybe you should re-read point 1.
Docker doesn’t “bypass” the firewall. It manages rules so the ports that you pass to host will work. Because there’s no point in mapping blocked ports. You want to add and remove firewall rules by hand every time a container starts or stops, and look up container interfaces yourself? Be my guest.