Sometimes I wonder if I'm serving clients well by pushing them from WordPress to ExpressionEngine. Then I look at sites I’ve been running for years and I can count on one finger the numbers of times I've had to respond to a critical security issue.
Once a quarter I update EE to the latest version; I don't think any of those updates has changed editorial workflows unexpectedly.
About once a year I make sure the whole environment is up to date.