Agreed, updates are probably at some point going to break things, and you're going to have to spend time fixing them, maybe even recovering from backups... As I said, an operations problem.
Leaving things without upgrades is also a problem as well though, due to security problems.
That is very true, that's also why having (working) backups is so important, or even knowing what to back up and restore, so you don't end up overwriting old vendored packages/dependencies but can restore the configuration/data instead.
I'd go as far as to suggest that updating is something that you must do while you have any sort of a stake in the overall outcome of the thing you're working on, given how destructive breaches and getting hacked could be. That also does mean that you will absolutely need to take the operations overhead into account and plan for it.
Leaving things without upgrades is also a problem as well though, due to security problems.