> If I forget to update OpenJDK, Oracle could come after me

I must have missed that section of the GPLv2.

Oracle does distribute a different (not OpenJDK) Java distribution under a special not-open-source no-cost license, which includes a stipulation that you can't use updates after the next LTS release. This only adds to the confusion: you really only need Oracle's special distribution if you want paid Oracle support for it or their stuff that requires it.