The first bit of advice here is to always run drush up on a dev or staging site first, before running it on a production site. Sometimes, due to bugs or incompatibilities, upgrades can break a previously-working site. It is therefore always best to test your upgrade before bringing it live. After testing, it is also best if you move the exact files that you tested from dev to live rather than run drush up again. You never know, someone might publish a new release while you are testing!
When you run drush up on your test site, you will notice at the end that Drush will report either "No database updates", or it will run an updatedb, and you will see a report on the database changes that you made.
If there are no database updates required, then generally speaking, it is safe to update your code without putting your site in maintenance mode. Note, however, that there is a small risk that a web request might be processed when only some of the files in your site have been upgraded. Since it only takes a small amount of time to git pull or rsync your files, this is only likely to be a problem if your site gets a lot of traffic. If you are concerned about this, you could put your site into maintenance mode, or better yet, put up an 'in progress' page by adjusting your web server's configuration.
If database updates are required, it is a good idea to put your site into maintenance mode before updating it. After copying the files to your production system, run drush updatedb to run the database updates. When database updates are required, it is common for them to do operations such as add new columns or tables to your database. The new code in core or your contrib modules may assume these schema changes have been made, and may crash if run prior to the completion of the database update. drush updatedb can take a little while to run, so it is more likely that you might serve a web request before it finishes.
Note that if there ever is a problem, it would only be observed by a small number of clients, and would be fixed with a simple page refresh in the browser. Since you are probably watching your updatedb run, you would probably never see these failures yourself. It is best to keep your site clean from transient failures, though, so maintenance mode is the safer option.
It is a good idea to script the update operation, so that it will run smoothly and easily every time. See drush_deploy and upgradepath for two example projects that do this.
