There are two extreme models of administering a system:
Model 1: Install something that works, configure it to your liking, and then leave it alone. Motto: "Never mess with a running system". Or: "The correct way to manage a computer is to hire a man and a dog; the man to feed the dog, and the dog to bite the man if the tries to touch the computer". Apply only security patches, and those also only if absolutely necessary. This model works really well for a few years, because the system is very stable, requires very little maintenance work, and the absence of maintenance work also means less chance for screwing it up. Where this runs into its limitations: At some point it stops working. For example, you can't download packages for it any longer. Or you need a feature that isn't there. When this model stops working, it is an enormous amount of work to do the next upgrade; since it requires jumping many versions, and much software will break, you are often better off getting a new system (at least new system disk, sometimes a new computer) and installing/configuring a successor system from scratch.
Model 2: Update all the time. I run freebsd-update and pkg upgrade roughly twice a week, and it is very little hassle (usually takes a minute or two), and very rarely does something require manual intervention. But the total amount of work adds up, and there is always risk that a minor breakage occurs. And that risk and fear is psychologically worse than the work. I live in constant panic that my wife gives me "the hairy eyeball look" and says "my VPN to work stopped working right after you messed with the server yesterday, so I'm driving to my office on the weekend". Or that my son can't print his math homework because a new version of lpd came in last night and wiped out my hardware-specific patch, and I'll be at fault that the B he gets in calculus will ruin his chance to ever become a great scientist.
In the end, it is a risk/reward/effort tradeoff. There isn't a right answer for everyone, since the answer depends on the weights/costs you put on these factors. Personally, I think in the long run model 2 is better. It does require being well-organized; for example one has to have a complete list of all ports that need to be rebuilt from scratch, all local patches, one can't lose the source code to local utilities, one has to have Makefiles ready to go, and so on. YMMV.
