What is best practice for updates?
There is no clear policy for this. But it is good to put CiviCRM behind a firewall/VPN. That way you can only access civicrm if your ip address is allowed. For connecting external websites/application you can then use CiviProxy.

This way CiviCRM and your data are secure, no matter whether your CiviCRM installation has securty issues. 

My personal advice is that when it aint broken don't fix it. So that also means for updates, if your system still works and you don't need any new features keep it as it is. We are brainwashed by Android and Windows which install updates automatically and so we all think it is good to install updates regularly however I cannot think of a rationale for that. 

Also I do think that installing updates is not much work from a technical perspective. But with every update you have test your whole setup and see if nothing ain't broken. And this test work is usually quite a lot of work. 

My experience is also that the organization using CiviCRM is also changing over time. And that those business changes might also require some (minor) changes in your CiviCRM setup/configuration. And usually when doing those kind of things it might be worth to also update to the latest version.