I've been asked this a number of times this year.
If you don't update the content managment system (WordPress or Drupal) the chances are it will get hacked and that's not a risk you should take.
So here's a copy of an email I sent to a client recently:
Content management systems need to be updated regularly to prevent hackers taking advantage of them; for Drupal it’s about 6 times a year, this is when I’ve updated yours over the last 12 months
There are modules (so add ons like Google Analytics and text editor etc) that can easily be user updated at the click of a button but I don’t charge for that anyway.
What needs manually updated is the core Drupal system. This involves logging into the control panel on the server, taking a backup of the database (in case anything goes wrong and you need to restore it) and then logging in with an FTP (file transfer programme) to the server and taking a back up of all the site files (so images, PDFs etc)
You then need to download the new version of Drupal from https://www.drupal.org/download, put the site into maintenance mode, upload the new files via your FTP programme to overwrite the last version, and run the update script.
All being well that’s it and take the site out of maintenance mode.
The trickiest part is if something goes wrong (which it can and I have numerous experiences of it) which means you end up with a blank white screen in place of your website. You then need to go back onto the server, go into a service called PHPMyAdmin, delete the current database, and upload your backup version. Hopefully then the site will appear back again but you need to work out why the update didn’t work.
So yes there are some bits of the process you can manage but I would not advise doing the database backup and restore part unless you are really confident with what you’re doing in PHPMyAdmin.
To be honest if you took it on and things went wrong and you asked me to fix it it would probably cost more than my basic update fee because I wouldn’t be sure about what you had done!
So there you go.
£10 a month (maybe more for larger sites) is not a bad insurance policy.