In reply to mark k..

@Ron, read only the start of your comment, and it is worth to reply to by itself.

Devs are not afraid of updates because they (think they) know where their backups are and how to recover from them. It is actually the non-techi people, for which everything is just pure magic, that are afraid to upgrade anything because it might break the magic. This is why wordpress has to support php 5.2, why 45% of wordpress sites run 4.3 or below, and why the jetpack 4.0 line is used by only 35% of jetpack users.

Some of us are freelancers which need to justify to their clients the hours they bill. It is nice that I can do a safe upgrade procedure, but what do I say to the client? If I tell him that he needs to pay for an hour work to fix a security issue with comments, what should I tell him when he says "WTF, but the site doesn't have any comment section at all"

Even when you "just trust" upgrades take time and time is money if the site is not a hobby site.