You can (and people do) run on k8s without the operator. But we use it to run our production spicedb instances, and it makes it a lot harder to get some things wrong that folks often have issues with: setting up the distributed cache correctly, stepping through phased migrations correctly, etc.
automatic updates are optional, you can pin to a specific version if you'd like