Different rules for different classes of systems.
Production systems only get upgraded when an upgrade/update is needed – security, stability, something major.
Development systems get more frequent updates, partially to shake out what’s happening and what updates need to move on into the production systems, and to test out those updates prior to putting them on a production system.
As an example, the update to the 3.18 kernel introduced dev_tree, which initially broke a lot of things.
Other systems have their own rules – Adafruit’s PiTFT boards (2.8 inch and 3.5 inch TFT displays) use a lot of their own kernel code, so some updates/upgrades aren’t worthwhile, as the PiTFT support has to be reloaded and brings things back to earlier revs.
Yes, you can treat Raspberry Pi systems as production systems – and have solid performance and uptimes of months (one of my PiAware systems has been running for 64 days).
And a common rule for all of them – they back themselves up to the server in the closet twice a week, so if something does go sideways, I’ve got backups. And since a backup only takes about 20 minutes, I’ll fire off a backup before doing anything that I might want to back out of.
For me, pretty much what k6rtm said…
I try to minimize updates, but I do a fair amount of RasPI projects and often an update is needed to turn on a feature I need. If I get word of a security issue I also update.
Other than than I just let things run.