Do NOT update working machines!!!

What do you mean with secure? There is a PC and it runs linux. The IT risk with my machine is a) lightning strike b) harddrive failure.
a) fixed by backup machine b) fixed with spare harddrive. ... Done!

If someone steals the PC it is also gone ...

p.s. Never change a running system, never run a changing system!

There are so many things that force a system upgrade, Components fail, new drivers needed and so on.
Without upgrades you would miss out on so many amazing improvements to LinuxCNC. QTplasmac and QTdragon are cases in point and running master branch with them is almost mandatory. What about 9 axis look ahead or S-curve jerk limited trajectory planning?

You just need a plan and a fall back position, I generally create a new config in Mesaconf or stepconf with very rough settings. Then once motion is confirmed, cut and paste all of my original ini and hal settings accross. That gets me running. Then its just a matter of adding all the new nice to have features. 3D probing, spindle torque display and so on. It only takes an hour or so.

Sorry but I like to stay pretty current. It makes support much easier. 
Did I tell you I get a bit annoyed when people say I have this working machine on 2.5 and it broke when I upgraded to 2.9? The truth of the matter, it broke several times all at once. Have you any idea how old 2.5 is? I've been using LinuxCNC for over 10 years. 2.7 was where I started but 2.8 came out before I finished my first config, so I upgraded straight away because It had features I wanted. I'd venture to say you will have less downtime if you stay current as you only make small steps at a time. upgrading 4 versions? you might as well adopt Mach 3!

When I updated I just started with a "fresh" hard drive. Then i do not have to deal with anything other than swapping SATA connection to get back from "experiment" to working.

My biggest problem is to keep some proper documentation (always bites me).
Trying to at least put a lot of comments into my hal and ini files.

I used to work in an environment that required high reliability. Hot-swap spares were the norm and that includes software. If you were updating software, it was done on a second (or sometimes even third) device to ensure that you always had 1 working production device and often a working spare as well. This philosophy is required in some industries, but many have moved away from it due to the cost. For a long time, downtime was forbidden. Now consultants or MBAs model the cost of downtime and can often justify it as critical savings in the short term. My local hospital recently rolled out a software update that brought down all their OR suites for over a week due to a driver issue.

I've been using Debian (and offshoots) for over 20 years and *nix before that. Original sysadmins were taught the importance of backups before updates as the OS itself doesn't provide a mechanism to roll back. There is an opportunity to provide better instructions to users on how to migrate a system safely, but it is a lot of work and there is always some risk.

I have linuxcnc running in a NixOS VM for simulations and might move my main controller to this one day.

I agree there is potentialy risk in upgrade an working machine.
I like have newest system with newest abilities, so I upgrade/install system very often.
Sometimes there is no problems, sometimes system or Linuxcnc became useless...
My last bad experience is MESA "error finishing read" error after upgrade kernel (some versions of 6.12 kernel works well, some not).
The best solution is full backup and two or few disks with many partitions.
The Debian 13 with LinuxCNC installed only for control the machine (xfce4, no CAD/CAM etc.) fits in 8 GB disk space.
It is only a few minutes for copy whole of that partition with dd...

In other side, I know the man who has above twenty (!!!) commercial (!!!) installations of Wheezy on very old commputers with LPT ports.
If you don't know what it means, I explain : 32bit systems with RTAI kernel (no realtime ethernet) with hardware in end of their life...
Any updates of this museum are imposible, and any old configs will not work with modern LinuxCNC... 

For me it really simple. I rely on my machines for my livelihood. Once I had it working satisfactorily, there was no need for any updates. These controls function exactly the same as the original controls, an update isn't going to change that.