my DO droplet was like 100 years old and I never tried once to update any software I had running on it or the OS, then said hmm that's probably bad. Now for most stuff other than password manager I had running on there, hack it, I don't even care. Not the password manager though, can't be risking that.
Got it. If you want to self-host again at some point you could add a VPN layer and configure unattended-upgrades with automatic reboots. With an Ubuntu Pro subscription (free for up to 5 personal devices) you can even get kernel live patching. Once that's taken care of you can automate the app updates with systemd timers / cronjobs and small scripts.