As I know, automatic updates popups only appear if you download Electrum from an illegal source, not from an official.
Asking the user to update the wallet with a fake version of electrum was possible in the versions older than 3.3.4.
If you are using the new versions, you are right. You should be safe.
In versions 3.3.3 and before that, there was a vulnerability which allowed servers to display any arbitrary message. Server could abuse this feature and display a message including a link to a fake website and ask the user to update the wallet through that website.