There is no one answer in the linux world. It's distro dependent, with different distros choosing different policies which you can choose from to match what you're looking for.
For example, Fedora will upgrade package versions and defaults often, because they release often. RHEL, which is made from a frozen Fedora version (for the most part), won't even upgrade versions of installed packages, but will instead back-port fixed into the old versions, so you are ultimately as stable as can be expected from running an OS, as without new versions and new features in packages there's little to worry about with regard to changing behavior.
Usually, that means you're responsible for knowing what to set for package defaults, and while they might change the default for a package such as OpenSSH at a point release (or in critical situations as a normal update), the way their config management works is that your existing systems will likely not see any change, but a new install might (there are different actions in different situations, but it's documented).
The main exception to the above is point releases, which are every six months or so, where they may take a subset of packages and allow newer versions of those to allow for new features, but with copious amounts of testing to hopefully catch any problems that might introduce. In some cases they may deem it safer to back-port a feature than to change the shipped package to a newer version (this is common for some kernel features, for example).
What this means in practice though is that you can choose to do regular security and bugfix updates automatically but stage and test point release updates, and do one or two systems to test whether it introduces problems.
Those are the benefits of an enterprise distributions, such as RHEL (and free derivatives such as CentOS and Rocky Linux) and Ubuntu LTS releases. The downside, if you can consider it that, is that they are so stable that five years later you'll find you're still running that same distro and your problem is that that majority of the software stack you're running is very old, and the annoyances from that continue to mount, and harder to migrate to something newer because there's been so much change in all the software that you can't assume that the configs will work cleanly.