95+% of users have no chance of even making this cost-benefit analysis because they cannot assess the scope or risk associated with the upgrade even if they wanted to. They have to rely on vendors making those assessments for them.
That's why I run Debian stable, which provides security updates and critical bugfixes for 5 years or more post-release with very limited changes otherwise. Maximized benefit, minimal cost.
FYI -- use Debian almost exclusively, been doing so for 20+ years and love it. (Well mostly, the last 5-7 years have been rough though.)
What Debian provides, is security updates for 1 year after the next stable release. That's it.
'5 years' is via LTS is volunteer support, provided by corporate and private donations, via a corporation in France. Their goal is to extend Debian oldstable's lifespan. The entire process is absolutely not the same as updates when running Debian stable.
For example, due to its volunteer nature, companies get to decide where they 'put their money'. What packages are prioritized. Rare / unused packages may never be addressed, depending upon funding.
Use PHP? Apache? The Linux Kernel? Sure, you'll see updates! Use rare package $x, and that may not happen, even though Debian Security would handle it.
I can also tell you via experience, that QA is not quite as good as Debian proper.
Still, is it a good thing? Sure! Is it managed by the Debian security team, 100% embracing all of its methods, and so on? NO.
I felt it is important for you (and others) to know this.
It's not as stable as Debian, not managed by Debian, and should ONLY be used as a stop-gap. You want stable?
Stay on Debian managed security updates!
What everybody does however is to use past experiences to evaluate the risks. Who hasn't had a system upgrade break something that took a while to fix? In these conditions, who wants their system to auto-update if the system is critical and it could happen at the worst possible moment?
As I said I try to keep my system up to date, but if I know that I have an important deadline in the near future I'm likely to postpone updates to avoid shooting myself in the foot.
Most Windows updates are security or bug fixes only. The exception being the twice yearly feature updates. These have been an issue mostly because Microsoft had been using a random subset of Home users as beta testers for new updates. However, they are being less aggressive with this now.
Oh, that might explain my experience a bit. I've never had any issues with automatic Windows Updates managing 50+ with a mix of common software. Every one of them was always Pro or Enterprise though.
Ran Arch for a couple years for dev with a nightly cronjob of (iirc) "pacman -Syuw --no-confirm". That broke regularly but I knew it was a bad idea.
You make it sound like an irrational fear but there's a real cost/benefit ratio to consider when you upgrade a machine. I personally always try to keep my machines up to date but stuff does break from time to time. Like last week an arch upgrade updated some system library to a new major version which forced me to regenerate my python dev env for work (which is not a trivial task because for various reasons our environment is fairly custom).
Windows is even worse in that regards because its upgrades are often significantly more intrusive (and they use automatic update to push new features and products, which is a great way to have people attempt not to update just to avoid them).
IMO if OS vendors want their users to update at all costs they shouldn't force it onto them, instead they should develop better transactional update systems that effortlessly and reliably let you revert to a previous version if something goes wrong. Then there would effectively be no reason to fear any update, since you know that at any point if something goes wrong you can just click on "undo update" and you're good to go.