When is BBS updated?

Is there a specific time for the update?

Or should the administrators wait until they discover many vulnerabilities in the system and then fix them and then update??