dpkg extracts the files from the deb package before installing the dependencies

If unattended-upgrades is not installed on the host system prior to
securedrop-hardening package being installed it will prompt to overwrite
the included 20auto-upgrades file with the unattended-upgrades version.
This will leave auto upgrades disabled. Since securedrop-interfaces is
installed before securedrop-hardening also included unattended-upgrades package there.

When I break up the monitor package into monitor-ossec and monitor-hardening, I'll do
the same there installing monitor-ossec first (including unattended-upgrades) so not to
rick admin disabling auto-upgrades