Sorry about the inconvenience!
Plugins in WordPress don’t have the option to “auto-update” like WordPress installations (yet).
However, if you’ve activated your email address (http://generatepress.com/knowledgebase/install-activate-addons/#activate), you should receive notifications in the Dashboard that updates are available. Can you confirm that the email address you purchased with has been activated?
I’m working on additional ways to notify users that updates have been released, including an option to sign up for email updates – I’ll hopefully have that ready to go soon.
As for security – if there’s ever any security issues found in our add-ons or theme, we would contact everyone via email, Twitter, Facebook and these forums letting them know how to update to the secure version. So far, no security issues have been found.
Let me know 🙂