Nothing per se, but if he's not automatically upgrading then there's a potential easy vulnerability from previous versions to exploit.

See: http://www.drupalexploit.com/