In my experience, it is usual for software to have bugs.
I do backups, and test even the security-critical patches in a staging environment before doing it in production.
For minor version updates, it makes sense to wait for at least a few months before updating (usually a few weeks after the first patch). For major version updates, it can take about 6 months for a really good patched version.
If many people didn't update right after a release, that process would take longer, as many bugs get missed during development and beta testing (XenForo for one has many different add-on combinations and server configurations for different users, so it is practically impossible to account for all that before a release).
For a comparison - I use WordPress a lot, and WordPress urges people to set their websites to automatically update as soon as an update is released. It is a lot more pushy/annoying when you don't update ASAP, compared to XenForo.
Relja