Upgrades can be a single "composer update" and then committing the composer.lock file. Mine are a bit more as I review changes between versions as well. I am very careful about what plugins I use for this very reason honestly. If it's not well-behaved enough and requires the ability to write outside of uploads then it's not used.