WordPress core, plugins, and themes should be updated as soon as updates are available - tested first, not installed blind. Weekly is a sensible rhythm for most sites; daily monitoring is better.
The short version
Updates patch security holes as well as adding features. The gap between an update being released and a site applying it is exactly the window attackers work in, so the honest answer is "promptly" - with the caveat that an untested update can break a site just as surely as a missed one.
The safe rhythm
Take a backup before anything updates. Apply updates to a copy of the site first, so a conflict shows up somewhere harmless. Then apply them to the live site, and check the important pages still work. For most sites that's a weekly cycle; security-critical updates shouldn't wait for the schedule.
Why "just click update" isn't the answer
Most sites run a dozen or more plugins, any of which can conflict with another or with a new WordPress version. The update that fixes a security hole in one plugin can break the page your revenue depends on. Tested updates are the whole difference between maintenance and roulette.
Rather just have it handled?
WordPress Care Plans
Updates tested and applied weekly, included.