@Elpie - as Viper said, if you can't update WordPress on a regular basis (for any of the reasons you mentioned) you shouldn't be using it. It's that simple.

People use it for the simplicity, the wide array of plugins, and the huge community that offers support, but all those benefits have a cost as well.

In much the same way, editing core files should only be done with the realization that it's going to cost you in the long run when it comes time to update it. It might save you time at the beginning but you'll have to pay the piper at some point.

As I said, I think it's time for Automattic and WP to take security to a professional level and the recent release cycle has been ridiculous but there's just no excuse for not updating, especially when the most recent release is nearly a month old.