Starting in 2023 (and updated over the years) I wrote an automation to auto apply updates every few days based on a bunch of criteria:

• consider all updates: HA, HAOS, add ons, HACS updates (I’d included HACS updates myself before they had integrated with the update framework)
• update is more than 1 or 3 days old (I’m not interested in being an early adopter for the most part)
• ’sensitive’ vs. standard updates (I wait longer for updates to HA, HAOS, Zigbee2MQTT, ZWave2MQTT, few others)
• order of updates, like apply standard HACS updates first, then update others
• logs everything it does
• keeps state, so if there’s a version bump between installs it delays another slot before considering to apply it
• skip all esphome updates by default now (didn’t initially, but don’t see the value in pushing updates to the devices unless there’s a material gain)
• I have controls on it so like if I’m going out of town I pause it until I’m back just in case

I usually get core HA updates to the y.m.2 version around mid-month so I skip teething pains of most new releases. I’ve had to do a roll back once - I’m still not sure why as I just reapplied the update manually and it worked. It has meant that I’ve needed to update parts of my configuration as HA has progressed, but for the most part that hasn’t been a lot of upkeep.

I think HA is still such a moving target, and especially now with AI beating on everything security wise it’s even more important if you expose it to the world. Given HA’s role leaving it unpatched could be opening your home up to being abused.

HA is still a bit of a hobby project and needs a bunch of care and feeding. I do hope that there’s a point when the dev team doesn’t need to reachitect and refactor configuration. Eventually I hope it’ll be more like phones where updates are relatively transparent.