With Magento being open source and with the ever changing landscape of internet security, frequent updates and security patches are required and highly recommended. Your Magento agency should advise on this and give a transparent breakdown of potential time and costs associated. Magento agency support plans often include minor version updates and security patches.