Yes, I agree with both of you.

I'd like to see a section in the documentation, referenced from the installation instructions, with prescriptions about keeping Guix(SD) up to date. Say "Keeping a Guix(SD) system up to date". It could have, for example, what to do as a root user, what to do as a non-privileged user.

Also, I usually subscribe to the news feed of the software I use regularly. With Debian, for example, I update the system every time I get notified of new updates.[1] I'm subscribed to Guix news too, but I haven't seen posts recommending users to update their systems to fix security issues (except for release announcements). That's something I'd like to see too.

Guix website is currently using Haunt, which allows to generate feeds per tag in the blog, so we could even recommend users in the documentation to subscribe to a "security" news feed to keep informed of important updates.

My 2¢,

[1]: https://www.debian.org/News/2017/20170114