The first thing I always do is disable auto-updates. Auto updating does not deserve the level of trust we put it in it. Just a few months ago, Google's creepy invisible updater rendered people's Apples unbootable if they didn't have SIP enabled, which many people including myself have good reason not to[1]. Thankfully, I had already blocked Keystone Agent with an immutable folder.
This auto-updating treadmill we've been sold on is really beneficial for developers, but it causes some major problems for end-users.
I have honestly lost track of the number of times I have had an update cripple a device. My iPad got ruined, my PS3 lost Linux, iTunes removed p2p music sharing in a deceptive update, Cisco gutted residential routers and forced people onto their crummy new platform[2]... I could go on and on. And this isn't even counting Android. I had a friend lose Miracast support in an Android update, minutes before he had to give a presentation.
And those are all examples of updates functioning as intended, even though they are against the interests of the users. I can add more citations if anyone is curious.
So no, if you use your device for anything important, then don't update it until you've made a backup, and had a chance to read up on any potential problems. It really says something that in this day and age, I've had to become much more vigilant about backing up my data than ever before.
[1]: https://news.ycombinator.com/item?id=21064663
[2]: https://tech.slashdot.org/story/12/06/29/1425210/cisco-pushi...