How to upgrade Debian unattended if it's not a rolling release
Unattended upgrades could be configured to install more than the security release. Even with the stable release, one can add the official APT source for the Debian backports.
Fortunately, with the introduction of the syspatch(8) and sysupgrade(8) utilities this is much simpler than it used to be. And, release numbers are just sequential with one point number, i.e. 7.0 was just the next release after 6.9, nothing more is implied by the "major" number ticking up.
I think I’m a bit scarred when a docker upgrade took my entire stack down because of an api mismatch with portainer, so I’m trying to be present during upgrades.
Edit: I’m talking about Debian of course. I’m not familiar with OpenBSD.
I think you can also do unattended release upgrades by using the 'stable' release alias in sources. That will probably result in some stuff breaking since there will be package and configuration churn.
https://wiki.debian.org/AutomatedUpgrade
It is feasible to do if you prepare ahead of time, and you can even do automated offline upgrades with apt-offline and some scripting.
Mostly works fine apart from bugs in unattended-upgrades, or when my boot partition runs out of disk.