Personally, I have Update Manager installed on all my live sites.
While I use composer to manage all of my sites, I am do not blindly
composer update and push out. I like to read changelogs and make sure I regression test thoroughly.
So, I have email notifications for updates turned on for all of my sites. Most are set for daily notification for all updates, but a handful of internal-only sites (as in behind the firewall) set for security updates only.
Then I can test and plan what updates go out when during my maintenance windows. Or for security updates, triage how critical they are to go out outside the normal windows.