Finally.

People need to update things. Yes they might break, hence you do not update on the live site until you tried things out on a test site (or local version).
I had to update a client this morning from 4.0 to 6.0.2.

Yes, I had to remove a few plugins and replace them with newer ones that do the same thing but they are recently updated.

I have zero sympathy for anyone's site that gets hacked because you have plugins/themes/core that hasn't been updated since I was a teenager (I turned 44 a week ago).
IF you hire someone to maintain your website, they give you whatever excuse to not do it right away...then fire them. If they are paid to do updates but use the automatic updates feature.....fire them.

There is absolutely no excuse to have an old out of date WP, Drupal, Joomla or whatever else.........

Obviously if the person you hired them is in Sydney Australia (05:54) even though I, in Eastern Time (Toronto, Canada) is at 15:54...yes I would understand why they would not do the updates right away at 6 minutes before 6am.