There have been a few major ones this year, I'm sure they are fixed at this point though. https://app.opencve.io/cve/?vendor=jellyfin

If it breaks I either fix it (often it's just an issue where the new version needs extra config added), or roll back to a backup and pin the old version temporarily if it really went wrong and I can't recover otherwise.

Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.

I use one of the maintained forks of watchtower.

I use it to auto update within stable versions for things that are reputable enough to not make breaking changes, so nginx, apache, wireguard, traefik, etc. In over 10 years of running Plex I don't think I've experienced a breaking update in the last 5-7 years at least, so I consider it safe enough. Any other software like Immich that I'm not sure if that's safe, I keep it behind a vpn and update manually. But for things as big as nginx especially I feel very safe letting it auto update within a major version.