Apart from certain highly specialized embedded applications that will always be used in a specific, protected scenario, you do need to upgrade your distribution. For any machine with a network connection (and for most that don't, too), you need to apply security fixes. You also need to keep up with the times for some things, including, literally, with timezone definition changes as the laws change. If you add new hardware then you may need newer drivers, and of course you may want to run newer software one day.
No matter what type of distribution you choose, there are always upgrades. Some distributions like Arch Linux and Debian unstable or testing have “rolling releases”, i.e. upgrades come in small pieces (a few packages at a time) and there are upgrades pretty much every day. Other distributions are more stable, with only critical bug fixes (mostly security) coming at unscheduled times, and major releases only once or twice a year at most.
Either way, your installation will reach end of life if you don't upgrade it. The only difference is whether it takes days (Arch) or a decade (RHEL).
Upgrades can break things. Unattended upgrades are generally a bad idea. Do unattended upgrades on your server only if you've rehearsed them first on an identical machine (same hardware or close enough, exact same set of packages, same configuration except for the minimum difference in network configuration and user accounts).
For a server, I strongly recommend a stable distribution. That way you only run into risky upgrades every couple of years. Security upgrades are generally safe.
On Debian, you can point the source list at
stable rather than a release name such as
jessie. The advantage is that your system will always follow new releases automatically. The downside is that one day you'll wake up with 3GB of downloads and 2 hours of disk I/O to perform the upgrade. It's better to schedule these things.