So I am having a discussion with a coworker today, and he let something out that I thought was bizarre, as I'm getting ready to apply security updates to one of our production servers.
"You should never apply kernel updates." His line of reasoning is that you don't know if it's going to break any of the linked modules, which could subsequently cause pieces of the application to break down. I would buy into this if perhaps whatever you were running required you to build custom kernel modules - but for your standard apps is this really a concern? FWIW the box in question runs an apache webserver and a database.
I'm of the opinion that regularly applying security updates is necessary to protect against flaws, and that the risk he identified is outweighed by the benefit of having an up to date kernel in your production environment.