Damned if you, damned if you don't. Update constantly and you might get a fun little surprise shipped to you in one of the updates. Update occasionally and you'll miss the critical fix(es) to a vulnerability you have.

I think the only way out is extreme scrutiny of all updates and paranoid minimization of all attack vectors, but the industry is only going to settle into that local minimum after we go through some devastating breaches.