If anything, using something like Chef will make it easier to perform those updates if the need actually arises.
The bar is 'If I never ssh into this box and leave this app alone for 3 years, how likely is that box to get rooted?'
The thing you need to test then deploy are upgrades to your language and framework/app, and those present exactly the same problem on heroku or on say a vps. You can't just redeploy your app without testing on a new config, and deploys to heroku are no easier or harder than deploys to your own server once set up.
What heroku buys you is not having to deal with updating the web server and database, as they'll deal with all of that, but I wasn't aware that they provide a fully managed service like say wordpress.com, and I don't see how they could for custom apps.