it's a tradeoff between fear that an update will break it and fear that a adversary will break it.
highly depends on the circumstances if/when auto-updates make sense, but once you have seen uptime in the decades range, most don't want to go back to ephemeral systems.
I never had a debian installation break from automated security updates.
highly depends on the circumstances if/when auto-updates make sense, but once you have seen uptime in the decades range, most don't want to go back to ephemeral systems.