It's really not that bad. Most of the investment is early on, after that servers just run. I use unattended updates to keep patches coming in while I'm doing other stuff. Updating from a Debian stable repo won't break your stuff.