The amount of testing we need to do with each update makes it almost impossible to keep updating risk free. We would have to test for so long, that by the time we're done, the next module will be ready. It's just too complex a site with too many contrib modules. Maybe if we had a full time person just on that. Despite what the "community" says, my tendency is to only update security changes.