Software updates are not only about new features. Many updates patch vulnerabilities that attackers can search for across thousands of websites at once.
The longer a known vulnerability stays online, the easier it becomes to exploit. Public writeups and automated scanners often appear after patches are released.
For small sites, the safest update workflow is simple: make a backup, update one layer at a time, test the site, and keep a note of what changed.
Remove software you cannot update. An abandoned plugin, old CMS theme, or forgotten script is not harmless just because it is no longer used in your navigation.