Can you use a UI to upgrade the underlying container? It's not with docker-compose?

If so that feels a bit like an anti-pattern, just like the WordPress container which updates the WP files inside the container itself, the container just contains the webserver, php and database.

The AIO solution creates several docker containers that all get updated through their assisted update process. In general, I've been quite happy with it, myself. I have it running on my Unraid machine. The only problem I have intermittently is when Unraid seems to rename container names in special circumstances. I have to go and recreate the aio container. Otherwise, it's been very smooth sailing for me; and, the AIO solution definitely runs faster than my original single Docker container solution.

So you pass in the docker socket and the AIO container runs docker commands on the host?

That is correct, yes.

It sounds a bit like using the same password for all your services... Hack a Nextcloud instance, gain root on any system through Docker,

I would assume (hope) that the AIO container itself is not exposed to the internet, only some of the containers it starts.