> There can be performance improvements or security updates in new releases

Of course the opposite could also be true - performance could degrade or new security issues could be created.

I agree with your second statement that with a proper CI/CD pipeline, updates should be managabale.

Also: https://twitter.com/gabro27/status/1173547934132178944?lang=...