If I never saw another update notification on my personal sites again, I'd be a happy man. Update All The Things.

For client work, everything is strictly version controlled, but I'm going to experiment with forcing auto updates in my development environment (you can use the 'auto_upgrade_is_vcs_checkout' filter to force updates even if your site is under version control) and manually checking those changes into Git which will then make their way to production. It means I get the benefit of auto updates in my development environment, and I still control deploying those updates.