given the number of inexperienced people self hosting WP I would say both end user and wordpress. WP should push out messages. Like "If you don't update someone can take over and destroy your site". Just saying new update ain't enough I think. There should be a reason for upgrading. Easy access "changelog" with the important points perhaps.