But this means you update a week after the release that fixes an issue in your current deployment. My org had a similar cooking off period for updating packages, the reason to do this is to protect from supply chain attack, but that is not the primary vector for most attacks. Far easier to find a vulnerability in an already installed package. The difference is that supply chain attacks involve a level of social engineering to take over accounts, whereas vulnerabilities can be found much more easily with AI.

This would have been good advice 12-18 months ago but I think it needs to be reconsidered in the current environment. Not to say it doesn't have a use but 1 week is a long time in tech. That's like 4 GitHub outages.