I think you're right. Despite Google's latest horrible promise to wreck user choice, auto-updates are possible from third-party app stores in Android right now, and they have been for a long tint. And it's possible for competing app stores to update the same app, provided the update is signed by the same key as the original.

In F-Droid, for example, you only need to manually click the system level Install button once per app; after that it can update apps without asking. But if you download a more up-to-date version of the package from a different source, you can install it there too (if you approve the installation of the app from any source, and not just the first one you used).