>But it still holds that keeping a single system up to date takes like a few hours a year max
This... simply isn't true.
Sure, you can just set your system to update and reboot once a week, and then when an update is incompatible with some of your software, well, spend the time to clean up the mess.
This is going to break every few years, and that mess is going to take significant effort, especially if you haven't touched that software for a few years.
A more proactive approach is to watch the security mailing lists, updating when appropriate, but that's an hour or two a week of effort... remember, you have to keep your full stack updated; your cms, your webserver, your os, etc, etc... you need to watch for holes in each of these things, then when there is a hole, you need to figure out if applying the update will break your current configuration, and then apply said update
Either way, it's a significant amount of skilled labor.
Sysadmins don't get paid what SWEs get paid, but we ain't free.
To go deeper into what others will respond to this with, yes, distributions cover some of this. But consider that every few years your distro will go out of support.... and you will have to figure out how to upgrade that, which is often pretty painless, but it does require either a high tolerance for risk or a lot of reading.
Then consider that other bits under your stack; your webserver, your php, your cms, all those packages/versions are sometimes changed mid-release and often changed on those major releases.