Software updates

That update notification is almost always fixing something that attackers already know how to use.

This is the part that makes delaying them a worse bet than it feels. The flaws being patched are not theoretical and not secret; they are frequently published, which is how the update came to exist. Putting it off for a month is choosing to stay reachable by attacks that have already been solved, at exactly the point when the largest number of people know about them. Turn on automatic updates where you can. It is the single highest-value thing most people can do and it requires no ongoing effort.