Yes if you are using WordPress then it’s your own responsibility to update and backup your WordPress site. In the recent past there has been some security issues concerning both the WordPress core and some plugins (including popular plugins). So what you can do is that just activate “automatic” updates for your WordPress core and all of your plugins and update will be done behalf of you and you can stay calm back on your seat.
As what i have seen so many WordPress site owners often neglect the update and backup part easily and by doing so you’ll be inviting a lot of problems. If you are looking to install a new plugin then make sure you to check when was the last time that plugin was updated, check whether it’s compatible with your WordPress version and then always check for the updated change logs and what it was updated. If any plugin is haven’t updated in years time and not compatible with your WordPress version then don’t go for it or test it on your development environment.
So after every update is done to your site the next step is to take a backup of your entire site including database and store it in multiple locations including one in your local system (make sure your system is free from virus and your system has firewall), then send your few backup copies to the cloud including DropBox or Google Drive.
So take care of your WordPress site and keep updating it and back it up at regular intervals and be safe.