"It’s quite likely that other, unauthorized folks, are touching your mail system more frequently than you with such a lax attitude."

This is complete nonsense. I cannot imagine that there is anything particularly magical that requires something other than regular security updates on any server.

Manual intervention is borne of changing requirements or broken things.

Why should an email server for a handful of users require a lot of manual intervention?