For most things you can put a cooldown period on updates, like wait 7 days, since most of the backdoors and supplychain attacks get caught in that window. I hope.

Do package managers for Linux distros have this, like dnf/yum/apt/pacman? I use min-release-age =14 for npm now as a default but should start using it everywhere it's possible

Except when there's an actual urgent patch: See recent PHP or Ruby ecosystem updates. Then you are just a sitting duck for a week