It's such a stark contrast, my home servers just run unattended-upgrade (on Debian) with no problems, I just do the major version upgrade every year.

Meanwhile everything consumer and most enterprise is as you said, "don't upgrade if it is not broken, else you WILL feel pain".

Companies basically trained bad security habits into their user base