@John: Yes, completely agree. For a browser to be usable in an enterprise it needs to allow for its patching to be fully manageable. Of course that comes as part of a broader requirement for enterprise config management, including the ability to lock down parts of the config, and manage that config via policy.

@Peter Powell: Yes agreed. Part of the appliance nature means no surprises, so whilst minor updates should default to being invisible, major updates should have some visibility. I'd argue that unless a change potentially breaks a previous use case of the browser (e.g. removal of a feature), the default mode for a major update should be for it to install automatically with the user receiving a notification of the change including a clear explanation. This feels most appliance like, and fits in with the push to keep users on current versions. 
I'm guessing the reason Chrome gets away with never notifying users of an update is that it's never actually had major changes, at least not whilst I've been using it. Whereas changing from IE 8 to 9 silently is going to scare users.