Doing gradual smaller changes over time and reducing the delta removes the risk of having to update everything at once down the road. We use dependabot to prevent our services from becoming the legacy issues that no one wants to touch.

We'd rather fix small issues continuously than have giant overhauls when a bunch of packages need to get updated because we weren't staying on top of it.

I think about it like a CD pipeline for dep updates. Less risk if you ship smaller amounts of code.