Hi Sarah

"Any theme not in use has got to go – with one important exception: a default theme for fallback."

That's the way I usually go, just in case I have any problems with the theme I'm using.
Deleting themes is no big deal only takes a minute or so.

I check my own sites when I add posts and if any plugins need updating I update them and then update them on client sites.

I use a few security plugins plus the Sucuri paid plugin, which is pretty cheap once you are using it on ten or more sites and setup is nice and easy.