unattended-upgrades is enabled by default, so security updates are handled automatically. You can also just destroy and recreate the box once in a while, without any extra cost.
But it is of course completely up to you. If you trust your VPN provider when they say they don't log anything, I guess you are fine.