However, once set up, you can slap unattended-upgrades on top and have a (usually…) self-updating and self-maintaining system, which is quite neat.
Probably the way to go is Nix/Guix. Transactional upgrades and declarative configuration.
(Nevertheless, its also prompted me to put "try Arch out" on the TODO list for the next down-time period..)
The beauty of Debian is that unattended-upgrades works well enough that most of the time you can defer updates (within one release) to it and don't have to bother at all.
My only gripe is that if it breaks, it breaks hard. Botched Arch installations are much easier to fix.
debfoster explicitly asks you which packages you want to keep and removes everything else. You can use it to strip down an existing Debian installation to just the base packages.