This is a confusing comment because Debian/Ubuntu/etc (you referenced apt) have separate security repositories that exist for this purpose. They have only security fixes and don't try to unnecessarily fix "other" stuff. I have not heard of the security repos pushing out a breaking update before.
`unattended-upgrade` uses only a subset of repos (ie security) and does this for you. If you actually wanted to schedule reboots, it can do that too.
`unattended-upgrade` uses only a subset of repos (ie security) and does this for you. If you actually wanted to schedule reboots, it can do that too.