Kind of feel about that about software updates.

I used to have a personal project site that ran Drupal. I don't know how things are now, but back then, every module could be updated automatically, except for the Drupal Core itself which had to be updated manually.

The one time I went "oh shit, a core update - nah, I can leave it after the weekend", the site got hosed by malware.

(It's a Jekyll site now. Drupal was a bit of overkill for it anyways.)