The deliriously unhip Wordpress installation running my website has auto-updates for minor versions turned on. Major updates still require my intervention.

It pretty much always just... works. New exploits just get patched out.

Of course, with the exception of the new "Gutenberg" editor, WP has always been ultra conservative in terms of major usage change.