I have a heavily modified board and the "advanced update" either works as-is or requires some minor manual merging of conflicts. The latest 3.3.9 update from 3.3.8 took me less than an hour, including updating the live site.
I use a really helpful tool "
Beyond Compare" for double checking my work (i.e., comparing an updated version of my code against the current production code). There's other useful comparison tools out there, no doubt, but I like BC because it handles massive comparisons quickly and intuitively. If there's a major update, it can also do 3-way merges (parent source, the new version, and your current version). It helps you to see
just your changes, e.g., phpBB 3.2, phpBB 3.3, and your code based on 3.2. It answer the question: What actually changed that needs to be merged from my 3.2 based code to the (new) 3.3 base?
To the OP's question: There's almost always security patches, so yes, it's prudent to update. It's pretty rare that a release doesn't have some security fixes, even if they're just in dependent code outside of the phpBB base.