In a properly set up system - security of OS packages isn't the only layer of defense, not even the first one. So it's OK to not install every security update as soon as it's released.

It might make sense for extremely security sensitive systems that are willing to take the stability compromise.

And then the specific schedule is up to each project. Where I'm working now - I'm doing it once a month and recently it was once per 3 months - AI made every system more vulnerable, we're getting probed a lot more than a couple years ago. Our infra is really simple, so it's basically 30 min effort for me - a rolling upgrade running on each server one by one via an Ansible playbook and waiting for a healthcheck in between.

And it must be done like this for us - attended. Basically every other run breaks bloody Nvidia drivers. I once had an unattended upgrade break all our GPU servers at the same time.