Got to be at least partially offset by the likelihood of new code/major rewrites introducing vulns. Kinda curious how the numbers work out on this. Best to install patch updates but hold off on major versions by default?
This is what I generally advocate. Pin to a major version and ruthlessly update. Major versions are fine to delay until an opportune time, but never to the point where you're even close to being more than one major version behind.