> If you are moderately paranoid about security, you have to install all updates on day one

Until you don't (see High Sierra and the "empty root password" fiasco).