Alex, it should be pointed out that people who have hundreds of sites to patch and haven't turned on auto-updates or aren't allowed because of the network they're on, like big gov't networks, have to deal with that as a part of their job, just the same as the IT department has to stay on top of operating system and software updates. It's no different.

Otherwise, turn on auto-updates or migrate to a managed host that updates after performing checks, like WP Engine does. I had emails from all of my DigitalOcean droplets minutes after release and all 87 of my WPE sites were patched within 4 hours. That's 100x4 security patches for 4.2 that I didn't lift a finger to update.

3 years I would have agreed with you before there were auto-updates and managed hosts were still kinda new. Now people have options, unless they don't for protocol reasons, in which case, complaining is just complaining.

Security updates are there for security, so I'd be careful complaining about updates that protect sites.