I used to put main kernels compiled for a very standard distro, on production, and manually updated twice a month after testing a bit each release.

  * One time I dodged a data corruption bug with a default, common filesystem, that obviously got rapidly patched.
  * Last time and very recently, main kernel introduced a bug that made NFS just don't work for clients trying to connect, until a patch was released and applied for those servers.

On the other hand, also saw a vendor mainstream bogus update that rendered the boxes unpingable after a reboot. Could patch before a reboot was needed so day saved.

You're almost never safe. But I agree some testing helps. Anyway not everyone has the infra and/or resources.