> I've watched it shift from "Only update if we can prove we are impacted" to "Update everything immediately just in case".

> [...] a much more cautious approach has become common.

I'd argue that this is a less cautious approach, not more. It takes time to carefully evaluate, review, and test each change.